AI agents and DynapiCMS
DynapiCMS is built so that the entire site — pages, templates, forms, content — is available through the GraphQL API. That is why a site can be handed to an AI agent (Claude Code, Cursor, any coding assistant with terminal access): it connects with a key, builds the site, and publishes it without ever opening the admin panel.
What an agent can do
Everything a human can do in the admin panel:
- create content types and fill them with records;
- assemble pages: routes, templates (Liquid), static files (CSS/JS/images);
- set up forms and flows — including payments, emails, and member areas;
- manage the query library, the media library, the subdomain, and a custom domain;
- verify the result before publishing (preview) and after (run logs).
What an agent needs to work
Two things — provided by a human:
- API key. In the admin panel: Access keys → Create. The key looks
like
dca_…. Working with a site requires thesite:manage,data:write, andmedia:writescopes (or a key with administrator permissions). - Endpoint URL. There is exactly one for everyone:
https://dynapi.ru/cms/graphql. The key itself determines which project a request belongs to.
The agent sends every request like this:
POST https://dynapi.ru/cms/graphql
Content-Type: application/json
X-API-Key: dca_…
The key is never passed in the URL (?api_key=) — only via the header.
Three tools
| Tool | What it is | What it is for |
|---|---|---|
| The dynapi-site-dev skill | A knowledge package: platform rules, recipes, API and Liquid references | Loaded into a coding agent so it builds the site by the platform’s canon instead of guessing |
| flowctl | A command line: flow validation, publishing, content, run logs | The agent checks and ships changes with commands instead of raw HTTP |
| GraphQL API | The platform’s full API | Everything else: content, schema, media, domains |
Security
- The key grants access to the entire site. Do not post it in public repositories or chats; it revokes in the same admin panel with one click.
- The preview host (
https://preview-<subdomain>.dynapi.ru) always shows drafts — visitors of the main address never see them until a publish happens. - An agent cannot step outside your project: the key is bound to it.
Next: The dynapi-site-dev skill →