# Blog Studio

Base path: `/api/tools/blog`. Use the focused skill from `/api/ai/tools` to confirm the current API catalog.

## Access and roles
Every private blog route authenticates with the caller's existing session or GiveGigs API key, then checks blog membership and capability. Roles are OWNER, ADMIN, EDITOR, AUTHOR, REVIEWER, and VIEWER. Each route enforces its own capability; never infer access from a blog or post ID. API keys still need the route's normal `read` or `write` scope. Do not pass keys in URLs.

## Main operations
- `GET /api/tools/blog/blogs` lists blogs the caller owns or belongs to.
- `POST /api/tools/blog/blogs` creates `{name, slug?, description?}`.
- `GET /api/tools/blog/blogs/{blogId}/posts` lists posts in an accessible blog.
- `POST /api/tools/blog/blogs/{blogId}/posts` creates a draft; follow the route schema and include the current version rules.
- `GET|PATCH|DELETE /api/tools/blog/posts/{postId}` reads or edits/deletes an accessible post. PATCH is version-aware; preserve optimistic concurrency fields.
- `POST /api/tools/blog/posts/{postId}/publish` publishes through the route's publish role check.
- `GET /api/tools/blog/posts/{postId}/revisions` lists revision history. Restore via `POST /api/tools/blog/posts/{postId}/revisions/{revisionId}/restore`.
- Comments: GET/POST `/api/tools/blog/posts/{postId}/comments`; resolve via PATCH `/api/tools/blog/posts/{postId}/comments/{commentId}`.
- Members: GET/POST/DELETE `/api/tools/blog/blogs/{blogId}/members`; only owner/admin capabilities accepted by the route.
- GET `/api/tools/blog/blogs/{blogId}/export` and `/backup` export only the caller's authorized blog. `/repository` reads configured repository metadata.

All POST/PATCH/DELETE actions can affect shared content or access and need a human review in Valley CMDR. The endpoint rechecks role, ownership, input schema, and version after approval. Never claim a draft is public until publish succeeds. Public blog reading is separate under `/api/public/blogs`; it does not grant private editing access.

## Limits
Blog publishing, comments, revisions, exports, backups, and team membership are available through these server routes. Theme editing and visual composition remain in the website UI where no matching API action is listed. Never use admin or moderator routes.