API Reference

Authenticate with email and password. Sets an httpOnly admin_token cookie valid for 1 hour. Rate-limited to 5 attempts per 15 minutes per IP.

Clears the admin_token cookie, ending the session.

Returns the currently authenticated user decoded from the JWT token.

List published blog posts with pagination. Optionally filter by tag or category.

Retrieve a single published blog post by its URL slug.

Create a new blog post. The author field is set from the authenticated user.

Update an existing blog post by slug. All fields are optional (partial update).

Permanently delete a blog post by slug.

List all projects ordered by sort order.

Create a new portfolio project.

Update an existing project by ID.

Delete a project by ID.

List all experiences ordered by sort order.

Create a new experience entry.

Update an existing experience by ID.

Delete an experience by ID.

List all skills ordered by sort order.

Create a new skill.

Update an existing skill by ID.

Delete a skill by ID.

Health check endpoint. Pings the database and returns status.

Submit a contact form message. Inputs are sanitized. Rate-limited to 5 submissions per 15 minutes per IP.

List all contact form submissions, newest first.

Mark a contact submission as read or unread.

Retrieve all site settings as key-value pairs.

Bulk upsert site settings. Each key is created or updated.

Returns aggregate counts for the admin dashboard: posts, projects, experiences, skills, contacts, and unread contacts.