Skip to content

Join the Seedly owners community →

Help Center

Letting an AI Agent Edit Your Sites

Seedly Sites has a small HTTP API built for AI agents. An agent you run can read a client site and make content edits, and everything it writes lands as a draft.

Last updated

Seedly Sites has a small HTTP API built for AI agents. It lets an agent you run read a client's site, understand how the page builder works, and make content edits, without giving it the keys to your whole platform.

Everything an agent writes lands as a draft. A person still reviews and publishes, and you still press Deploy. That is the whole safety model, and it is deliberate.

You do not need this to run Seedly Sites. Skip this page unless you actually want to connect an agent.

What an Agent Can Do#

  • Read a client's brand, contact details, navigation, and page list
  • Read the full block tree of any page, including drafts
  • Change text, headings, buttons, images, and section settings
  • Add, move, duplicate, and delete blocks
  • Change a row's column layout
  • Build out a page by cloning whole sections from your vetted library
  • Create a new page from those sections
  • Ask whether a page is valid before saving it
  • Write and revise blog posts by sending Markdown
  • Put images from your media library onto pages, and add new ones
  • Set a blog post's featured image
  • File posts under your existing categories and tags
  • Read the status of page builds you queued

What an Agent Cannot Do#

  • Publish anything, or schedule a publish for later
  • Edit a page or post that is already scheduled to publish
  • Deploy a site
  • Change which tenant a page belongs to, or a page's password
  • Change a page's title, slug, or SEO settings. Blog posts are the exception, since writing a post means writing its title
  • Invent a section. It can only clone ones you have already vetted
  • Create raw HTML blocks
  • Set column widths by hand, because those belong to the row's layout preset
  • Use an image from anywhere except your own media library
  • Invent a category or tag
  • Queue a page build, which stays an operator action

If an agent tries any of these, it gets a clear refusal explaining what to do instead, rather than a silent failure. An agent can also ask the site what it is allowed to do before it starts, instead of discovering the boundaries by being refused.

The Safety Model#

Three things hold at once, and they are what make this safe to hand to software:

Draft only. Nothing an agent writes through this API is live. Publishing and deploying stay human actions, so the worst case is a draft you did not want, which you discard. The rule lives in the agent API, not in the key: the key belongs to an ordinary user, and used against the CMS's general API it can do whatever that user's role allows. Give the agent's user the Contributor role if you want the key itself unable to publish; Contributor cannot add new images, only use ones already in your library. Contributor and Author can only revise pages and posts the agent created itself; to edit your existing pages it needs Editor, which can also publish through the general API.

Only the sites you link. Every call names one site, and the key reaches only the sites its user is linked to, so an agent cannot read or touch a client you did not link it to.

Its role decides what it can do. Permissions follow the role you give it, exactly like a human team member, so you can grant a narrow role and widen it later.

Vetted Sections, Not Freehand Layout#

An agent cannot invent a section. It builds pages by cloning sections you have already approved, which is what keeps generated pages inside your design system rather than producing something that technically renders but does not look like your work.

The practical consequence: the better your saved-section library, the better an agent's output. If it is producing pages you do not like, add the sections you do want rather than trying to prompt around the ones you have.

Setting It Up#

The step-by-step, including how to create and rotate the API key, is in SETUP/operations/ai-agent-access.md inside your download. You will need your CMS address, an API key, and the slug of the site the agent should work on.

Treat the key like any other credential: one per agent, rotated when someone leaves or when you suspect it has leaked.

Was this page helpful?