Get a website — Rikochey

GET /api/websites/{website}

A website's record: contact details, logo, departments served.

Check	Value
Authentication	`Authorization: Bearer …`, or an `Origin` matching the website's host
Cache	response cached for one hour server-side

This endpoint accepts two kinds of callers: a server holding a token from the organization, and the browser of a visitor on the website itself. In the latter case, the Origin is authoritative, as for the other browser endpoints.

The two do not receive the same record:

with a token, the full record below;
from a browser (no token), only the id and the fields the website publishes in its script (window.WEBSITE, chosen in the website's settings): the same data a visitor can already read on the page, never more. See What the script publishes.

curl https://api.example.com/api/websites/019f0000-0000-7000-8000-00000000000a \
  -H 'Authorization: Bearer 42|pQ7d…'

Response 200

{
    "data": {
        "id": "019f0000-0000-7000-8000-00000000000a",
        "name": "Portails & Fermetures",
        "host": "portails-fermetures.fr",
        "url": "https://portails-fermetures.fr",
        "email": "[email protected]",
        "company": "Portails & Fermetures SARL",
        "address": "12 rue des Remparts",
        "zipcode": "68000",
        "city": "Colmar",
        "country": "France",
        "phone": "03 89 00 00 00",
        "logo": "https://…/logos/7/logo.png",
        "departments": [{ "code": "68", "name": "Haut-Rhin" }],
        "created_at": "2026-07-08T10:51:02+00:00",
        "updated_at": "2026-09-15T09:22:41+00:00"
    }
}

Errors

Code	Body	Cause
`401`	`{"message": "Invalid or expired token."}`	Unknown or expired token
`403`	`{"message": "This token does not grant access to this website."}`	Token from another organization
`403`	`{"message": "The holder of this token no longer has access to this organization."}`	The token's bearer left the organization, or is no longer its owner or admin
`403`	`{"error": "origin_not_allowed"}`	Call without a token, from an origin foreign to the website
`404`	`{"message": "Website not found."}`	Unknown UUID
`403`	`{"message": "This website is disabled."}`	Website disabled by its owner

What the record never contains

The website's signing key is never included, under any condition, for any caller. Received requests, statistics and visits are not exposed by this API: they are viewed in the panel, or exported from the leads list.