Wiki.js

Returns a single comment by id, with its source and its rendered HTML.

Returns one group with its global permissions, its page rules and its members. This is the authoritative answer to "who can see or edit what" — and it is what update_group needs as its starting point, because that mutation replaces the whole rule set.

The sidebar navigation as configured, per locale. This is curated by hand and is not the page tree — get_page_tree is what reflects the pages that actually exist.

Reads one page, addressed by page_id or by path plus locale. Choose a mode: "metadata" for everything but the text, "outline" for the headings only (cheapest way to see what a long page contains), "content" for the source, "rendered" for the HTML. With mode=content, either pass section to get one heading’s worth, or offset and max_chars to read the page in windows — a large page will otherwise be truncated to fit the result budget.

Returns the version of a page that is newer than the one you read — what update_page points at when it refuses to write. Shows who saved it and when, so the change can be redone on top instead of discarded.

Lists the pages and folders directly under a path — the structural view a wiki has and a search does not. mode "ALL" returns both folders and pages, "FOLDERS" only folders, "PAGES" only pages. Wiki.js offers no limit on this query, so a very wide level is truncated to the result budget.

Returns a single historical version of a page, including its full body as it was then. To find out what changed between two versions, diff_page_versions is far cheaper than reading both.

Version, database, host summary and the site’s own title and description, plus totals for pages, users, groups and tags. The first call to make when something is not behaving — it proves the URL and the API key work at all. Fields describing the host filesystem and database host are deliberately not requested.

Full detail for one account, including its group memberships and whether two-factor authentication is active. No credential of any kind is returned — Wiki.js does not expose one.

Searches the actual text of pages with a regular expression, by fetching them and matching locally. This exists because Wiki.js’ default search engine does not index page content at all. It is the expensive path — one request per page — so narrow it with path_prefix, tags or locale, and keep max_pages small. Returns matching lines with context, not whole pages.

Lists the wiki’s API keys with their expiry and whether they are revoked, plus whether API access is switched on at all. Wiki.js stores only a truncated form of each key and never returns the secret, so nothing here can be used to authenticate.

Lists the folders directly under an asset folder. Folder 0 is the root. Wiki.js returns one level at a time, so a deep tree needs one call per level.

Lists the images and files in one asset folder. Folder 0 is the root. Assets are flat within a folder and Wiki.js has no search across them, so finding one means walking list_asset_folders.

Returns the comments on one page, addressed by path and locale — not by page id, which is the one place Wiki.js asks for the path instead. An empty list can also mean comments are switched off for the wiki; get_site_info reports that.

Lists the wiki’s groups with how many users each has. Groups marked isSystem are Wiki.js’ own Administrators and Guests — they exist always and should not be deleted.

Which locales are installed and which one is the default. Worth checking once per wiki: the locale is part of a page’s identity, and every page tool here falls back to WIKIJS_LOCALE, so a wiki running on "de" needs that set or nothing will be found.

Lists the stored versions of a page, newest first, with who changed what and when. This is the one Wiki.js query that really paginates. The version ids here are what get_page_version, diff_page_versions and restore_page_version take.

Returns every page together with the internal links it contains — the wiki’s link graph for one locale. Useful for finding what would break before moving or deleting a page. Wiki.js returns the whole graph at once and offers no filter, so on a large wiki this is truncated.

Lists pages with their metadata, newest first by default. The result reports how many pages matched as well as how many are shown, so a short answer is never mistaken for a small wiki. Wiki.js has no offset for this query, so narrow with tags, locale, creator_id or author_id rather than paging. Returns no page content; use get_page for that.

Which search engine this wiki uses. Worth knowing before trusting search_pages: the default "Database - Basic" indexes only titles and descriptions, so nothing written inside a page is searchable until a real engine is configured and the index rebuilt.

The configured storage backends — git mirrors, S3 buckets, local file dumps — with their sync status and last error. Credentials in their configuration are redacted.

Every tag in the wiki, with its display title and when it was last used. Tags are the one cross-cutting index a wiki has, so this is often a better starting point than search — feed a tag back into list_pages to see what carries it.

Lists the wiki’s user accounts. `providerKey` says how they log in — "local" for a Wiki.js password, anything else for an identity provider. Email addresses are returned because they are the login.

Moves all pages from one locale to another, across the whole wiki. The usual reason is a wiki set up under the wrong locale code. Every page path changes, so every external link into the wiki breaks. Requires a confirmation token.

Moves a page to another path, another locale, or both. Internal links pointing at the old path are NOT rewritten by Wiki.js — check list_page_links first if that matters.

Deletes stored page versions older than a cutoff, across the whole wiki. The versions are gone permanently — this is the one maintenance operation that destroys data. Requires a confirmation token.

Recomputes the folder structure Wiki.js derives from page paths. The repair for a navigation tree that disagrees with the pages actually present, usually after a bulk import or a database edit. Page content is untouched, but it walks every page and can take minutes.

Reindexes every page in the active search engine. Required once after switching away from "Database - Basic", because the new engine starts empty and search silently returns nothing until this runs. On the basic engine it does nothing. Search results may be incomplete while it runs, and it can take minutes on a large wiki.

Renames an asset. Pages embedding it by its old URL will break — Wiki.js does not rewrite them.

Forces Wiki.js to regenerate one page’s HTML from its source. The fix for a page whose rendering is stale after a theme or renderer change. Changes no content and cannot lose anything. It does, however, bump the page’s updatedAt — and update_page compares that against when you last read the page, to catch somebody else saving in between. So a render between your read and your write makes update_page refuse *your own* next write, saying the page changed after you read it. If that happens, call get_page again and then write; nothing was lost. Better still, render after writing rather than befor…

Starts Wiki.js’ own password reset for a local account, which emails the user a link. No password is chosen or returned here. Requires a confirmation token.

Rolls a page back to a stored version. The current content is not lost — it becomes another entry in the history — but the live page is replaced. Requires a confirmation token.

Revokes an API key immediately and for good — Wiki.js has no way to un-revoke one. Note that this can revoke the key this server is using, which would cut its own connection. Requires a confirmation token.

Full-text search — but read this first: on a default Wiki.js the search engine is "Database - Basic", which only indexes page titles and descriptions, NOT the text inside pages. The result names the active engine so you can tell. If the engine is basic and you are looking for something written inside a page, use grep_pages instead. Results carry no excerpt; follow up with get_page.

Finds tags matching a fragment. Cheaper than list_tags on a wiki with hundreds of them, and the usual way to check what a tag is actually called before filtering list_pages by it.

Finds users by name or email. Use it to resolve a person to the id that list_pages (creator_id, author_id) and the group tools take.

Switches Wiki.js’ whole API on or off. Turning it off disables every API key at once, including this server’s — after which the only way back is the web administration UI. Requires a confirmation token.

Switches an account on or off. A deactivated account keeps its pages and groups but cannot sign in — the reversible alternative to delete_user. Requires a confirmation token.

Switches an account’s second factor. Turning it OFF weakens that account and is the reason this is gated; turning it on forces the user to enrol at their next sign-in. Requires a confirmation token.

Takes one account out of one group. Requires a confirmation token — removing somebody from their only group leaves them able to sign in and see nothing.

Replaces the body of a comment. Wiki.js keeps no history for comments, so the previous text is gone.

Replaces a group’s name, permissions, page rules and login redirect wholesale — this is not a partial update, and omitting a rule deletes it, just as omitting redirect_on_login resets it to "/". Read the group with get_group first and send back the full set with your change applied. Requires a confirmation token, because this is the call that decides who can read and edit the wiki.

Changes a page. Pass content to replace the whole body, or edits for surgical find-and-replace — each edit’s old_text must appear exactly once, and an ambiguous or missing match is refused rather than applied to the wrong place. Before writing, this checks whether somebody else changed the page since it was read and refuses to clobber them; pass force=true to overwrite deliberately. Metadata fields can be changed on their own, without touching the text. That refusal is a normal result and not an error: it explains what to do — read the page again with get_page, redo the change on top of what …

Changes a tag’s name or display title across every page carrying it. Renaming affects all of them at once, which is the point and also the risk, so it needs a confirmation token.

Changes an account’s details or its group membership. The groups list replaces the existing one rather than adding to it — use assign_user_to_group for a single addition.

Uploads an image or file to an asset folder, so it can be embedded in a page. Content is passed base64-encoded and the content type is derived from the extension. SVG, HTML and XML are refused: Wiki.js serves assets from the wiki’s own origin, so those can carry script that runs for every reader. Note that Wiki.js 2.x has no GraphQL mutation for uploads at all — this uses the editor’s own route, which is undocumented and could change in a future Wiki.js release.

Marks an account’s email as verified, which is otherwise done by the user clicking a link. Requires a confirmation token.