curl --request POST \
--url https://app.orgo.space/api/v1/website_menu_items \
--header 'Api-Token: <api-key>' \
--header 'Content-Type: application/json' \
--data '
{
"location": "Boston Common, Boston, MA",
"parent": "/api/v1/website_menu_items/1",
"label": "Primary",
"description": "Quarterly chapter meeting open to all members.",
"linkType": "https://civic-collective.example.com",
"page": "/api/v1/website_pages/1",
"url": "https://civic-collective.example.com/agm",
"style": "string",
"position": 42,
"isActive": true
}
'import requests
url = "https://app.orgo.space/api/v1/website_menu_items"
payload = {
"location": "Boston Common, Boston, MA",
"parent": "/api/v1/website_menu_items/1",
"label": "Primary",
"description": "Quarterly chapter meeting open to all members.",
"linkType": "https://civic-collective.example.com",
"page": "/api/v1/website_pages/1",
"url": "https://civic-collective.example.com/agm",
"style": "string",
"position": 42,
"isActive": True
}
headers = {
"Api-Token": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Api-Token': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
location: 'Boston Common, Boston, MA',
parent: '/api/v1/website_menu_items/1',
label: 'Primary',
description: 'Quarterly chapter meeting open to all members.',
linkType: 'https://civic-collective.example.com',
page: '/api/v1/website_pages/1',
url: 'https://civic-collective.example.com/agm',
style: 'string',
position: 42,
isActive: true
})
};
fetch('https://app.orgo.space/api/v1/website_menu_items', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://app.orgo.space/api/v1/website_menu_items",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'location' => 'Boston Common, Boston, MA',
'parent' => '/api/v1/website_menu_items/1',
'label' => 'Primary',
'description' => 'Quarterly chapter meeting open to all members.',
'linkType' => 'https://civic-collective.example.com',
'page' => '/api/v1/website_pages/1',
'url' => 'https://civic-collective.example.com/agm',
'style' => 'string',
'position' => 42,
'isActive' => true
]),
CURLOPT_HTTPHEADER => [
"Api-Token: <api-key>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://app.orgo.space/api/v1/website_menu_items"
payload := strings.NewReader("{\n \"location\": \"Boston Common, Boston, MA\",\n \"parent\": \"/api/v1/website_menu_items/1\",\n \"label\": \"Primary\",\n \"description\": \"Quarterly chapter meeting open to all members.\",\n \"linkType\": \"https://civic-collective.example.com\",\n \"page\": \"/api/v1/website_pages/1\",\n \"url\": \"https://civic-collective.example.com/agm\",\n \"style\": \"string\",\n \"position\": 42,\n \"isActive\": true\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Api-Token", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://app.orgo.space/api/v1/website_menu_items")
.header("Api-Token", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"location\": \"Boston Common, Boston, MA\",\n \"parent\": \"/api/v1/website_menu_items/1\",\n \"label\": \"Primary\",\n \"description\": \"Quarterly chapter meeting open to all members.\",\n \"linkType\": \"https://civic-collective.example.com\",\n \"page\": \"/api/v1/website_pages/1\",\n \"url\": \"https://civic-collective.example.com/agm\",\n \"style\": \"string\",\n \"position\": 42,\n \"isActive\": true\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://app.orgo.space/api/v1/website_menu_items")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Api-Token"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"location\": \"Boston Common, Boston, MA\",\n \"parent\": \"/api/v1/website_menu_items/1\",\n \"label\": \"Primary\",\n \"description\": \"Quarterly chapter meeting open to all members.\",\n \"linkType\": \"https://civic-collective.example.com\",\n \"page\": \"/api/v1/website_pages/1\",\n \"url\": \"https://civic-collective.example.com/agm\",\n \"style\": \"string\",\n \"position\": 42,\n \"isActive\": true\n}"
response = http.request(request)
puts response.read_body{
"id": 42,
"uuid": "01938d8e-9c4f-7c2a-b8e1-3f7a9b8c4f12",
"tenant": "/api/v1/tenants/1",
"location": "Boston Common, Boston, MA",
"label": "Primary",
"description": "Quarterly chapter meeting open to all members.",
"linkType": "https://civic-collective.example.com",
"page": {
"uuid": "01938d8e-9c4f-7c2a-b8e1-3f7a9b8c4f12",
"slug": "annual-general-meeting-2026",
"title": "Volunteer Coordinator"
},
"url": "https://civic-collective.example.com/agm",
"style": "string",
"position": 42,
"isActive": true,
"dateCreated": "2026-01-15T10:30:00+00:00",
"dateUpdated": "2026-01-15T10:30:00+00:00",
"parentUuid": "01938d8e-9c4f-7c2a-b8e1-3f7a9b8c4f12"
}Create a website menu item
Adds an entry to the header or footer menu. Validates the link target, refuses a second level of nesting, and rejects a linked page belonging to another organisation. Requires ADMIN_TENANT.
curl --request POST \
--url https://app.orgo.space/api/v1/website_menu_items \
--header 'Api-Token: <api-key>' \
--header 'Content-Type: application/json' \
--data '
{
"location": "Boston Common, Boston, MA",
"parent": "/api/v1/website_menu_items/1",
"label": "Primary",
"description": "Quarterly chapter meeting open to all members.",
"linkType": "https://civic-collective.example.com",
"page": "/api/v1/website_pages/1",
"url": "https://civic-collective.example.com/agm",
"style": "string",
"position": 42,
"isActive": true
}
'import requests
url = "https://app.orgo.space/api/v1/website_menu_items"
payload = {
"location": "Boston Common, Boston, MA",
"parent": "/api/v1/website_menu_items/1",
"label": "Primary",
"description": "Quarterly chapter meeting open to all members.",
"linkType": "https://civic-collective.example.com",
"page": "/api/v1/website_pages/1",
"url": "https://civic-collective.example.com/agm",
"style": "string",
"position": 42,
"isActive": True
}
headers = {
"Api-Token": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Api-Token': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
location: 'Boston Common, Boston, MA',
parent: '/api/v1/website_menu_items/1',
label: 'Primary',
description: 'Quarterly chapter meeting open to all members.',
linkType: 'https://civic-collective.example.com',
page: '/api/v1/website_pages/1',
url: 'https://civic-collective.example.com/agm',
style: 'string',
position: 42,
isActive: true
})
};
fetch('https://app.orgo.space/api/v1/website_menu_items', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://app.orgo.space/api/v1/website_menu_items",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'location' => 'Boston Common, Boston, MA',
'parent' => '/api/v1/website_menu_items/1',
'label' => 'Primary',
'description' => 'Quarterly chapter meeting open to all members.',
'linkType' => 'https://civic-collective.example.com',
'page' => '/api/v1/website_pages/1',
'url' => 'https://civic-collective.example.com/agm',
'style' => 'string',
'position' => 42,
'isActive' => true
]),
CURLOPT_HTTPHEADER => [
"Api-Token: <api-key>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://app.orgo.space/api/v1/website_menu_items"
payload := strings.NewReader("{\n \"location\": \"Boston Common, Boston, MA\",\n \"parent\": \"/api/v1/website_menu_items/1\",\n \"label\": \"Primary\",\n \"description\": \"Quarterly chapter meeting open to all members.\",\n \"linkType\": \"https://civic-collective.example.com\",\n \"page\": \"/api/v1/website_pages/1\",\n \"url\": \"https://civic-collective.example.com/agm\",\n \"style\": \"string\",\n \"position\": 42,\n \"isActive\": true\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Api-Token", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://app.orgo.space/api/v1/website_menu_items")
.header("Api-Token", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"location\": \"Boston Common, Boston, MA\",\n \"parent\": \"/api/v1/website_menu_items/1\",\n \"label\": \"Primary\",\n \"description\": \"Quarterly chapter meeting open to all members.\",\n \"linkType\": \"https://civic-collective.example.com\",\n \"page\": \"/api/v1/website_pages/1\",\n \"url\": \"https://civic-collective.example.com/agm\",\n \"style\": \"string\",\n \"position\": 42,\n \"isActive\": true\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://app.orgo.space/api/v1/website_menu_items")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Api-Token"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"location\": \"Boston Common, Boston, MA\",\n \"parent\": \"/api/v1/website_menu_items/1\",\n \"label\": \"Primary\",\n \"description\": \"Quarterly chapter meeting open to all members.\",\n \"linkType\": \"https://civic-collective.example.com\",\n \"page\": \"/api/v1/website_pages/1\",\n \"url\": \"https://civic-collective.example.com/agm\",\n \"style\": \"string\",\n \"position\": 42,\n \"isActive\": true\n}"
response = http.request(request)
puts response.read_body{
"id": 42,
"uuid": "01938d8e-9c4f-7c2a-b8e1-3f7a9b8c4f12",
"tenant": "/api/v1/tenants/1",
"location": "Boston Common, Boston, MA",
"label": "Primary",
"description": "Quarterly chapter meeting open to all members.",
"linkType": "https://civic-collective.example.com",
"page": {
"uuid": "01938d8e-9c4f-7c2a-b8e1-3f7a9b8c4f12",
"slug": "annual-general-meeting-2026",
"title": "Volunteer Coordinator"
},
"url": "https://civic-collective.example.com/agm",
"style": "string",
"position": 42,
"isActive": true,
"dateCreated": "2026-01-15T10:30:00+00:00",
"dateUpdated": "2026-01-15T10:30:00+00:00",
"parentUuid": "01938d8e-9c4f-7c2a-b8e1-3f7a9b8c4f12"
}Authorizations
Server-to-server authentication. Generate a token in the admin UI at
Settings → Developers → API Access. Send the raw token in the
Api-Token header — there is no Bearer prefix.
Tokens can be marked read-only at creation time, in which case the API
rejects any non-GET request with 403 Forbidden.
Body
The new WebsiteMenuItem resource
One entry of a tenant's website header menu, header buttons or footer menu.
Self-referencing for submenus, but only one level deep: a child cannot itself be a parent. The depth rule is enforced in WebsiteMenuService, not here, so the violation surfaces as a 422 on the request that caused it rather than as an exception during flush.
The header action buttons (HEADER_ACTIONS) are the same thing as a menu entry - a label pointing somewhere - drawn as a pill instead of a text link, so they reuse this table rather than living in a parallel structure.
Response
WebsiteMenuItem resource created
One entry of a tenant's website header menu, header buttons or footer menu.
Self-referencing for submenus, but only one level deep: a child cannot itself be a parent. The depth rule is enforced in WebsiteMenuService, not here, so the violation surfaces as a 422 on the request that caused it rather than as an exception during flush.
The header action buttons (HEADER_ACTIONS) are the same thing as a menu entry - a label pointing somewhere - drawn as a pill instead of a text link, so they reuse this table rather than living in a parallel structure.
"/api/v1/tenants/1"
Show child attributes
Show child attributes

