Public API

The public surface is read-only and requires no authentication — the collection_id in the URL is the only credential. Only published, non-deleted entries are ever served; drafts are never exposed. This is the surface the embed widget and your own renderer call.

All public endpoints live under:

https://api.vlozi.app/collections/c/…

You need a browser or server accessible to the internet; the gateway adds permissive CORS on these routes so a published embed works from any site you control (see Allowed origins).

The embed widget

GET /collections/c/embed.js

A self-contained vanilla renderer (no build step, no dependencies). It locates every [data-vlozi-collection] container on the page, fetches that collection's schema + published entries, and renders them. Static and cacheable (max-age=300).

<div data-vlozi-collection="YOUR_COLLECTION_ID"></div>
<script src="https://api.vlozi.app/collections/c/embed.js" async></script>

Paging: the widget silently walks the paginated /entries endpoint until it has fetched all published entries (it no longer truncates at one page), stopping when it reaches the data-vlozi-max cap on the mount container (default 1000, minimum 50):

<div data-vlozi-collection="YOUR_COLLECTION_ID" data-vlozi-max="200"></div>

Set data-vlozi-max to bound how many entries a busy collection renders (and how many pages the widget fetches).

See the Quickstart for layouts, CSS hooks, and template customization, and Embed & relations for details.

Collection schema

GET /collections/c/:collection_id/schema

Returns the public collection definition (fields, cardinality, render settings). Use it to validate entries you fetch, or to drive your own renderer.

curl "https://api.vlozi.app/collections/c/col_abc123/schema"

{
  "id": "col_abc123",
  "name": "Team Members",
  "cardinality": "many",
  "schema": {
    "fields": [
      {
        "name": "name",
        "type": "text",
        "label": "Full name",
        "required": true
      },
      {
        "name": "role",
        "type": "select",
        "options": ["Engineer", "Designer", "Sales"]
      }
    ]
  },
  "settings": {
    "titleField": "name",
    "imageField": "photo"
  }
}

List entries

GET /collections/c/:collection_id/entries

Returns the collection's published entries, paginated, ordered by their manual sort order (most recently published tie-break).

curl "https://api.vlozi.app/collections/c/col_abc123/entries"

Query parameters

Response shape

{
  "entries": [
    {
      "id": "entry_xyz789",
      "data": {
        "name": "Ada Lovelace",
        "role": "Engineer"
      },
      "publishedAt": "2026-08-20T10:00:00Z"
    }
  ],
  "total": 12,
  "page": 1,
  "limit": 25
}

Get a single entry

GET /collections/c/:collection_id/entries/:entry_id

Returns one published entry from that collection.

curl "https://api.vlozi.app/collections/c/col_abc123/entries/entry_xyz789"

Supports the same populate=true query parameter. A 404 is returned for an entry that is missing, draft, unpublished, or belongs to a different collection.

Allowed origins

An empty allowedOrigins (the default) means any origin may read the collection — the whole point of a public embed. If the collection has a non-empty allowlist, the gateway only serves requests whose Origin header is listed:

Errors

The expected client errors on the public surface return a plain message object — no extra code or request_id — so the response reads cleanly when a browser shows it:

{ "error": "Collection not found" }
// or:
{ "error": "This origin is not allowed to read this collection." }

A rare unhandled server error instead returns a more structured envelope that includes a request_id you can correlate with server-side logs:

{
  "error": "Something went wrong on our side.",
  "code": "internal_error",
  "request_id": "…"
}