# Full CRUD API Access

February 19, 2026

2minute read

The Marble API now supports **full CRUD (Create, Read, Update, Delete) operations**.

Previously, the API was read-only great for fetching your posts and rendering them on a custom frontend, but limiting if you wanted to programmatically publish content, sync from external sources, or manage your authors and tags.

Starting today, you have full Read & Write access to your workspace resources.

## Public vs. Private Keys

To support these new capabilities securely, we've introduced **Private Keys** alongside the existing Public Keys.

- **Public Keys** `mpk_...` **:** These keys remain Read-Only. They are technically safe to embed in your frontend code (e.g., a Next.js app) to fetch posts. But keep in mind anyone with access to them can query your content.

- **Private Keys** `msk_...` **:** These keys grant Write Access. They should be kept strictly on your server or build environment.

- Attempting to mutate data with a Public Key will result in a `403 Forbidden` error.

## Supported Resources

You can now perform full CRUD operations on:

- **Posts** (`/v1/posts`)

- **Authors** (`/v1/authors`)

- **Categories** (`/v1/categories`)

- **Tags** (`/v1/tags`)

For each of these resources, the following HTTP methods are available:

- `GET /v1/<resource>` - List all items (Public/Private)

- `GET /v1/<resource>/:slug` - Get a specific item (Public/Private)

- `POST /v1/<resource>` - Create a new item (Private Key only)

- `PATCH /v1/<resource>/:slug` - Update an item (Private Key only)

- `DELETE /v1/<resource>/:slug` - Delete an item (Private Key only)

## Example: Creating a Post

```
const response = await fetch("https://api.marblecms.com/v1/posts", {
  method: "POST",
  headers: {
    "Authorization": "Bearer msk_YOUR_PRIVATE_KEY",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    title: "Understanding Server Actions in Next.js",
    slug: "understanding-server-actions",
    content: "Building interactive applications used to require...",
    published: true,
    publishedAt: new Date().toISOString()
  })
});

const data = await response.json();
console.log(data);
```

### Automatic Formatting & Validation

We've baked in a ton of automatic validation to make the API a joy to use:

- **Auto-slugification**: Slugs for tags, categories, posts, and authors are automatically transformed (e.g., "Bad Slug Test!!" becomes "bad-slug-test"). No need to perfectly format them on your end.

- **Smart Caching**: Creating or updating resources instantly invalidates the cache globally in the background, ensuring your frontend is always up to date without slowing down the API response.

- **ISO Dates**: Date fields strictly adhere to standard ISO 8601 formatting.

You can create or manage your API keys, including setting expiration dates, directly in your [Marble dashboard](https://app.marblecms.com/) settings. Happy building.