---
title: "Change who can view this site"
method: PUT
path: "/api/v1/sites/{slug}/access"
tags: ["Sites"]
---

# Change who can view this site

`PUT /api/v1/sites/{slug}/access`

## Request

- Base URL: `https://api.dotsy.ai`
- URL: `https://api.dotsy.ai/api/v1/sites/{slug}/access`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer

Set `access` to `public` or `password`. A password is 8–128 characters. Omit `password` to keep the current one, which only works when the site is already protected. Turning protection on needs CORE on the owning workspace (`feature_requires_core`). Turning it off is always allowed. Only a site owner can change this (`site_owner_required`). Takes effect on the live site at once.

## Path parameters

- `slug` string, required

## Request body

- UpdateSiteAccessRequest
  - `access` 'public' | 'password', required
  - `password` string: Required to turn protection on. 8–128 characters. Omit it to keep the current password when the site is already protected.

## Response `200`

The site's visitor access after the change.

- SiteAccess
  - `access` 'public' | 'password', required: public, or password-protected.
  - `workspacePlan` 'free' | 'core', required: The owning workspace's plan. free when it has no plan row.
  - `canEnable` boolean, required: True when protection can be turned on: the workspace is on CORE, or this site is already protected.

## Other responses

- `400`: The body is not valid (`invalid_body`), the password is missing (`password_required`), shorter than 8 characters (`password_too_short`) or longer than 128 (`password_too_long`).
- `401`: Missing or invalid credentials.
- `403`: Turning protection on needs CORE (`feature_requires_core`), or the caller is not a site owner (`site_owner_required`).
- `404`: No such site.

---

[API](https://skmtc.dev/dotsy/apis/dotsy-api.md) · [All operations](https://skmtc.dev/dotsy/apis/dotsy-api/llms.txt) · [OpenAPI document](https://skmtc.dev/dotsy/apis/dotsy-api/revisions/4272ed3b85d7?raw)