Contents

Site

Basic data of the site the token belongs to.

Base URL, authentication and conventions of this API are on the Content Delivery API page.

get/

Get the site

Id, slug, name, status, default locale, enabled locales and the public URL of the site's frontend (as configured in Nucleo; null if not set).

Rate limit (all endpoints): 120 requests per minute per IP address.

GET https://api-brain.nucleoplatform.com/api/delivery/v1/acme/sites/12/
Authentication: Bearer token
Rate limit: 120 requests per 1m, per IP

Responses

  • 200The site.
    • dataSite
      Child attributes
      • idinteger
      • slugstring
      • namestring
      • statusstring
      • default_localestring
      • localesarray of string
      • frontend_urlstring (uri) | null
  • 401Missing or unknown delivery token.
    • messagestring
  • 404Not found. Also returned when the workspace slug is unknown or when the token belongs to another site (Nucleo never confirms that a site exists to a token that cannot read it). The text of message varies with the case: branch on the 404 status only.
    • messagestring
  • 429More than 120 requests in a minute from the same IP.
    Headers
    • Retry-After
    • X-RateLimit-Limit
    • X-RateLimit-Remaining
    • messagestring
Request
curl -X GET https://api-brain.nucleoplatform.com/api/delivery/v1/acme/sites/12/ \
  -H "Authorization: Bearer $NUCLEO_CMS_TOKEN" \
  -H 'Accept: application/json'
Response
{
  "data": {
    "id": 12,
    "slug": "acme-website",
    "name": "Acme Apparel website",
    "status": "active",
    "default_locale": "en",
    "locales": [
      "en",
      "it"
    ],
    "frontend_url": "https://www.acme.example"
  }
}
WebhookcmsRevalidate

Content published on the site

Sent by Nucleo right after a page or an entry is published, to the Revalidate URL configured in CMS → site → Settings, signed with the site's Revalidate secret.

Only publishing sends it. Deleting a page or an entry, and changes to menus or redirects, send no call: refresh those parts of your cache on a schedule.

  • Page published: path is / (refresh the whole site).
  • Entry published: path is /<collection-slug>.

Signature. Nucleo-Signature: t=<unix time>,v1=<signature>, where the signature is the lowercase hex HMAC-SHA256 of <t>.<raw body> keyed with the Revalidate secret. Verify it on the exact bytes received, compare in constant time and reject a t older than 5 minutes. Without a secret on the site the request is not signed. The secret body field is deprecated: it is still sent for older receivers and will be removed.

Retries. 5-second timeout, redirects not followed. Any 2xx is a success (the body is ignored); any other answer or no answer is retried after 1 min, 5 min, 30 min, 2 h and 6 h — at most 6 attempts, then the delivery is dropped and logged. Every attempt has the same id (also in Nucleo-Webhook-Id) and its number in Nucleo-Webhook-Attempt, so you can ignore duplicates.

Headers

  • Nucleo-Signaturestring

    t=<unix time>,v1=<hex HMAC-SHA256 of <t>.<raw body>> keyed with the Revalidate secret. Absent when the site has no secret.

    Example: t=1791115200,v1=5f2b6c0e9a8d4f7b1c3e2a6d9b0f8e7c6a5d4b3c2e1f0a9b8c7d6e5f4a3b2c1d
  • Nucleo-Webhook-Idstring (uuid)required

    Delivery id, the same on every attempt (equals id in the body).

    Example: 3f6c1a52-8e0b-4d7a-9c2e-1b5d7f9a0c34
  • Nucleo-Webhook-Eventstringrequired
    One ofcontent.published
    Example: content.published
  • Nucleo-Webhook-Attemptintegerrequired

    Attempt number, from 1 to 6.

    min 1max 6
    Example: 1

Request Nucleo sendsapplication/json

  • idstring (uuid)required

    Delivery id

  • eventstringrequired
    One ofcontent.published
  • sitestringrequired

    Site slug.

  • localestringrequired
  • pathstringrequired
  • published_atstring (date-time)required

    When the content was published.

  • secretstringdeprecated

    The Revalidate secret of the site (empty string if not set). Deprecated, verify Nucleo-Signature instead.

Expected response

  • 200Acknowledged. Any 2xx stops the retries.
Body
{
  "id": "3f6c1a52-8e0b-4d7a-9c2e-1b5d7f9a0c34",
  "event": "content.published",
  "site": "acme-website",
  "locale": "en",
  "path": "/blog",
  "published_at": "2026-10-04T12:00:00+00:00",
  "secret": "whsec_example_123"
}
Response
HTTP 200 — Acknowledged. Any `2xx` stops the retries.
Was this page helpful?