---
title: "List websites"
method: GET
path: "/websites"
tags: ["Websites"]
---

# List websites

`GET /websites`

## Request

- Base URL: `https://api.cactal.ai/v1`
- URL: `https://api.cactal.ai/v1/websites`
- Auth: HTTP bearer

Lists accessible websites. By default returns active websites: use `organizationId` to scope one organization, `scope=shared` without it for direct grants outside your memberships, or `scope=all` with it to combine both; supports `sort` by `createdAt`, `updatedAt`, or `name` and case-insensitive `search`, and each item includes `organizationSlug`, `primaryHostname`, and whether it is `shared`. Pass `status=deleted` with `organizationId` (requires organization-level trash access) to list restorable soft-deleted websites instead, each with its deletion time and purge deadline; deleted rows drop out when their 30-day restore window expires. Both modes use cursor pagination (default 20 per page, maximum 100). Fetch one website with `websites.get`.

## Query parameters

- `organizationId` string
- `cursor` string
- `limit` integer
- `sort` 'createdAt' | 'updatedAt' | 'name'
- `search` string
- `scope` 'shared' | 'all'
- `status` 'active' | 'deleted': Which websites to list. Defaults to `active`. `deleted` returns the organization’s restorable soft-deleted websites (requires `organizationId` and organization-level trash access) with their deletion time and purge deadline.

## Response `200`

A page of websites: active rows with hostname and sharing info, or soft-deleted rows with trash timing when `status=deleted`.

- object
  - `items` union[], required
    - union
      - object
        - `id` string, required: Unique website id.
        - `organizationId` string, required: Id of the organization that owns the website.
        - `name` string, required: Display name, 1–200 characters.
        - `slug` string, required: URL-safe identifier unique among active websites in the organization.
        - `customDomainsEnabled` boolean, required: Whether custom domains are enabled. Enabling is owner-only and makes the website a billable site; custom domains can only be attached while `true`.
        - `headVersion` integer, required: Latest draft source version number; starts at 1.
        - `publishedVersion` integer, nullable, required: Currently published version. `null` when the website is not published.
        - `createdAt` string, date-time, required: When the website was created.
        - `updatedAt` string, date-time, required: When the website was last modified.
        - `primaryHostname` string, nullable, required: Primary hostname the website is served from. `null` when none is assigned.
        - `organizationSlug` string, required: URL slug of the organization that owns the website.
        - `shared` boolean, required: `true` when access comes from a direct editor grant outside the caller’s organization memberships.
        - `faviconUrl` string, nullable, required: Public URL of the current favicon image. `null` when no available favicon is configured. Change it with the favicon endpoint.
        - `building` boolean, required: `true` while the built-in Cactal agent has a queued or running run on the website.
      - object
        - `id` string, required: Unique website id.
        - `organizationId` string, required: Id of the organization that owns the website.
        - `name` string, required: Display name, 1–200 characters.
        - `slug` string, required: URL-safe identifier unique among active websites in the organization.
        - `customDomainsEnabled` boolean, required: Whether custom domains are enabled. Enabling is owner-only and makes the website a billable site; custom domains can only be attached while `true`.
        - `headVersion` integer, required: Latest draft source version number; starts at 1.
        - `publishedVersion` integer, nullable, required: Currently published version. `null` when the website is not published.
        - `createdAt` string, date-time, required: When the website was created.
        - `updatedAt` string, date-time, required: When the website was last modified.
        - `deletedAt` string, date-time, required: When the website was moved to the trash.
        - `purgeEligibleAt` string, date-time, required: When the trashed website and its data are permanently deleted. Restore before this deadline with `websites.restore`.
  - `nextCursor` string, nullable, required: Opaque cursor for the next page. Pass it as the `cursor` parameter on the next request. `null` when this is the last page.

## Other responses

- `400`: Validation failed. The response `message` names the first invalid field.
- `401`: Missing, invalid, expired, or revoked API key.
- `403`: The authenticated principal lacks the required capability.
- `404`: The resource does not exist or is outside the principal’s access scope.
- `429`: Rate limit exceeded. Retry after the number of seconds in the `Retry-After` header.

---

[API](https://skmtc.dev/cactal/apis/cactal-api.md) · [All operations](https://skmtc.dev/cactal/apis/cactal-api/llms.txt) · [OpenAPI document](https://skmtc.dev/cactal/apis/cactal-api/revisions/9cd0fb5eacdd?raw)