whoila.com/v1

The make API.

One service layer for people in /admin and agents with a key. Discovery lives at GET /v1.

Auth

Customers sign in with Google at /auth/login. Agents send Authorization: Bearer whl_live_…. Mint and rotate keys in /admin?view=sites.

Own the domain

A Google login is not enough. Make and publish stay locked until Whoila sees the site’s verification token on that host — a file at /.well-known/whoila.txt, a whoila-site-verification meta tag, or a DNS TXT record. Hooks and adapter URLs must stay on that same host (https only). The DesignForever / WeddingHosts adapters only work when the record’s host is actually those domains. Hosts you operate (WHOILA_OWNED_HOSTS) are first-party and skip the public proof.

Usage and billing

Each successful make counts against the site’s monthly quota (trial: 3, subscribed: 50 unless you change the env). Subscribe with Stripe Checkout (POST /v1/sites/:id/checkout) after the domain is verified. Optional metered price STRIPE_PRICE_MAKE bills overage. Webhook: POST /stripe/webhook.

Make

POST /v1/make
{
  "site": "designforever",
  "kind": "blog",
  "brief": "Fifteen photographers who changed wedding pictures",
  "publish": true,
  "formats": ["pdf", "html", "png"],
  "wait": false
}

wait: false returns 202 and a job id. Poll GET /v1/jobs/:id until status is done. Artifacts:

GET/v1/jobs/:id/article.htmltypeset article

GET/v1/jobs/:id/cover.svg800×1200 jacket

GET/v1/jobs/:id/cover.htmlHTML5 jacket

GET/v1/jobs/:id/book.pdf6×9 PDF

Publish

POST /v1/jobs/:id/publish pushes the three artifacts to the site’s adapter or hooks. Make can also publish in the same turn when publish: true.

Generic hooks

For adapter: webhook, set three URLs. Whoila signs every body with HMAC-SHA256 using the site secret:

X-Whoila-Signature: sha256=<hex>
X-Whoila-Event: publish.blog | publish.thumbnail | publish.pdf

Blog hook receives JSON { event, kind, article, artifacts }. Thumbnail hook receives image/svg+xml. PDF hook receives application/pdf.

Host adapters

DesignForever — POST {origin}/api/admin/blog with x-vae-service-key. Optional thumbnail/PDF hooks on top.

WeddingHosts — POST {origin}/api/admin/blog with x-service-key. Same optional binary hooks.

Store the outbound key on the site in /admin. Whoila never sends it to the browser after save.