Contents
Site
Basic data of the site the token belongs to.
Base URL, authentication and conventions of this API are on the Content Delivery API page.
/Get the site
Id, slug, name, status, default locale, enabled locales and the public URL of the site's
frontend (as configured in Nucleo; null if not set).
Rate limit (all endpoints): 120 requests per minute per IP address.
Responses
200The site.application/json
dataSiteChild attributes
idintegerslugstringnamestringstatusstringdefault_localestringlocalesarray of stringfrontend_urlstring (uri) | null
401Missing or unknown delivery token.application/json
messagestring
404Not found. Also returned when the workspace slug is unknown or when the token belongs to another site (Nucleo never confirms that a site exists to a token that cannot read it). The text of
messagevaries with the case: branch on the404status only. application/jsonmessagestring
429More than 120 requests in a minute from the same IP.application/json
HeadersRetry-AfterX-RateLimit-LimitX-RateLimit-Remaining
messagestring
curl -X GET https://api-brain.nucleoplatform.com/api/delivery/v1/acme/sites/12/ \
-H "Authorization: Bearer $NUCLEO_CMS_TOKEN" \
-H 'Accept: application/json'const res = await fetch("https://api-brain.nucleoplatform.com/api/delivery/v1/acme/sites/12/", {
method: "GET",
headers: {
Authorization: `Bearer ${process.env.NUCLEO_CMS_TOKEN}`,
Accept: "application/json",
},
});
const data = await res.json();
console.log(res.status, data);<?php
require 'vendor/autoload.php';
$client = new GuzzleHttp\Client();
$response = $client->request('GET', 'https://api-brain.nucleoplatform.com/api/delivery/v1/acme/sites/12/', [
'headers' => [
'Authorization' => 'Bearer ' . getenv('NUCLEO_CMS_TOKEN'),
'Accept' => 'application/json',
],
'http_errors' => false,
]);
echo $response->getStatusCode(), PHP_EOL;
echo $response->getBody();{
"data": {
"id": 12,
"slug": "acme-website",
"name": "Acme Apparel website",
"status": "active",
"default_locale": "en",
"locales": [
"en",
"it"
],
"frontend_url": "https://www.acme.example"
}
}{
"message": "Delivery token required (Authorization: Bearer)."
}{
"message": "Invalid delivery token."
}{
"message": "Not found."
}{
"message": "Too Many Attempts."
}cmsRevalidateContent published on the site
Sent by Nucleo right after a page or an entry is published, to the Revalidate URL configured in CMS → site → Settings, signed with the site's Revalidate secret.
Only publishing sends it. Deleting a page or an entry, and changes to menus or redirects, send no call: refresh those parts of your cache on a schedule.
- Page published:
pathis/(refresh the whole site). - Entry published:
pathis/<collection-slug>.
Signature. Nucleo-Signature: t=<unix time>,v1=<signature>, where the signature is the
lowercase hex HMAC-SHA256 of <t>.<raw body> keyed with the Revalidate secret. Verify it on the
exact bytes received, compare in constant time and reject a t older than 5 minutes. Without a
secret on the site the request is not signed. The secret body field is deprecated: it is still
sent for older receivers and will be removed.
Retries. 5-second timeout, redirects not followed. Any 2xx is a success (the body is
ignored); any other answer or no answer is retried after 1 min, 5 min, 30 min, 2 h and 6 h — at
most 6 attempts, then the delivery is dropped and logged. Every attempt has the same id (also in
Nucleo-Webhook-Id) and its number in Nucleo-Webhook-Attempt, so you can ignore duplicates.
Headers
Nucleo-Signaturestringt=<unix time>,v1=<hex HMAC-SHA256 of <t>.<raw body>>keyed with the Revalidate secret. Absent when the site has no secret.Example:t=1791115200,v1=5f2b6c0e9a8d4f7b1c3e2a6d9b0f8e7c6a5d4b3c2e1f0a9b8c7d6e5f4a3b2c1dNucleo-Webhook-Idstring (uuid)requiredDelivery id, the same on every attempt (equals
idin the body).Example:3f6c1a52-8e0b-4d7a-9c2e-1b5d7f9a0c34Nucleo-Webhook-EventstringrequiredOne ofcontent.publishedExample:content.publishedNucleo-Webhook-AttemptintegerrequiredAttempt number, from 1 to 6.
min 1max 6Example:1
Request Nucleo sendsapplication/json
idstring (uuid)requiredDelivery id
eventstringrequiredOne ofcontent.publishedsitestringrequiredSite slug.
localestringrequiredpathstringrequiredpublished_atstring (date-time)requiredWhen the content was published.
secretstringdeprecatedThe Revalidate secret of the site (empty string if not set). Deprecated, verify
Nucleo-Signatureinstead.
Expected response
200Acknowledged. Any
2xxstops the retries.
{
"id": "3f6c1a52-8e0b-4d7a-9c2e-1b5d7f9a0c34",
"event": "content.published",
"site": "acme-website",
"locale": "en",
"path": "/blog",
"published_at": "2026-10-04T12:00:00+00:00",
"secret": "whsec_example_123"
}HTTP 200 — Acknowledged. Any `2xx` stops the retries.