# Spaicely

> Ask Claude, ChatGPT or Gemini to build your website. Spaicely registers your domain, puts your site online and keeps it secure. No WordPress, no updates.

This is the full text of https://spaicely.com/en-gb/ for language models. Prices are shown in euro, pound and dollar; the site shows the currency of the visitor's region.

## Hosting for websites your AI builds

Tell your AI. We put it in orbit.

Ask Claude, ChatGPT or Gemini to build your website. Spaicely registers your domain name, puts your site online and keeps it secure. No WordPress, no plugins, no updates.

Creating an account is free. You pay per site per month and can cancel any month.

## You talk. Your AI does the rest, in this order.

1. Search: Your AI finds an available domain name and tells you the price.
2. Register: Your AI registers it only once you agree. The domain is always in your name.
3. Build: Your AI designs the site: text, photos, forms.
4. Publish: Your site is live at your own address straight away. Every version is kept, so you can always go back.
5. Keep it current: "Add our Christmas opening hours." Done.

## Nothing to hack. Nothing to update.

Your site is made of plain HTML files. There is no PHP, no database and no plugin that springs a leak tonight. A WordPress vulnerability cannot touch you.

- European: Your site is stored in Frankfurt and Stockholm and delivered fast from all over the world. Spaicely is a Dutch company.
- Always HTTPS: Every domain gets a certificate automatically, and it renews itself, so you never have to think about it.
- In your name: Your domain is in your name, even when a web designer sets it up for you.
- Undo any time: Something went wrong? Your AI restores the previous version in seconds.

## Why a static website is faster and safer · Spaicely

Most sites run on WordPress. It builds every page again on every visit, while the content hardly ever changes. A static site does that work once, when it is published. After that every page is simply a file.

- The middle WordPress site needs 102 ms, six of the nineteen take more than 0.4 seconds and the slowest almost 2 seconds. The static sites: 37 and 46 ms.
- A few WordPress sites are just as fast. They use a cache: a plugin or service that keeps a ready-made copy of every page. That is in effect a static site, with WordPress behind it that you still have to update and secure.
- After the first byte come the images, stylesheets and scripts. A WordPress theme with plugins loads a lot of them. Below, the middle WordPress site from the measurement next to spaicely.com, also a static site, animations and all. Page loaded: 1,467 ms against 108 ms; Weight: 2,150 kB against 109 kB; Files: 70 against 13; Scripts: 26 against 3.
- 39.5% of all websites run on WordPress (W3Techs, 1 November 2026). That makes it the biggest target on the internet.
- 11,334 new vulnerabilities in WordPress plugins and themes in 2025, 42% more than the year before (Patchstack). 91% of them were in plugins. WordPress itself had six. Every plugin is someone else's code running on your server.
- On 1 November 2026, from a fibre connection in the Netherlands. First byte: seven times per site with curl, the middle value counts. Load time, weight, files and scripts: three times per site in Chromium without a cache, the middle value counts. The WordPress sites are ordinary sites of Dutch businesses; we don't name them. Sources: W3Techs and Patchstack.

Page: https://spaicely.com/en-gb/static-websites/

## Email on your own domain. Your AI sorts that too.

With a new domain or a transfer, your AI sets up the email records, so your mail arrives and stays out of spam. You choose how your email comes in.

- Keep your current email: Already using Gmail, Outlook or another provider? Everything keeps working. Your AI sets up the records on your domain.
- Forwarding: Mail to info@ lands in the inbox you already have. Each forwarding address costs £1.30 a month excl. VAT; Site includes room for one address, Pro for five and Shop for ten.
- Your own mailboxes: Real mailboxes on your domain. They are coming later; we will announce the price then.

## Emma writes the copy. The design stays yours.

Invite people with their own AI. You decide per person what they may change.

- Owner: Everything, including domain and billing
- Editor: Text, photos and opening hours
- Maintainer: Design and forms, not billing
- Viewer: See versions and statistics

## Build for your client. Hand over the keys with one link.

You build the site in your own account and hand it over with a link. Your client becomes the owner and the domain is in their name. Want to keep doing the maintenance? You keep that role, and your client always sees what you change.

Paying for your clients yourself? Then your discount grows with the number of sites.

- At 5, 15 or 40 client sites: 10, 15 or 20% off the hosting of all of them.
- With 5 or more client sites, your own site is hosted for free.
- If your client takes over the billing and you keep working on the site, you get 20% of what they pay for 24 months, as credit on your own invoices.

## One fixed price per site. Your domain at a fair price.

Per site per month, excluding VAT. Cancel any month.

| Plan | For | EUR | GBP | USD |
|---|---|---|---|---|
| Site | For freelancers and clubs | € 9 | £8 | $11 |
| Pro | For small businesses | € 19 | £17 | $22 |
| Shop | For selling online | € 39 | £34 | $45 |

An account in the United Kingdom pays in GBP, an account outside Europe in USD, all others in EUR; the currency is fixed from the first payment. Domain prices are set in euros and converted at the ECB rate on the day of payment.

- Site: Your own domain, always HTTPS; Forms, donations and cookie-free statistics; Restore earlier versions; 3 people per site.
- Pro: Everything in Site; Unlimited collaborators, with roles; Approve changes before they go live; Up to 5 mail forwarding addresses.
- Shop: Everything in Pro; Shopping cart and checkout; Up to 500 products; 2% plus VAT per payment, the money goes straight to you.

## Questions

### Which AI can I use?

Claude, ChatGPT, Gemini and coding assistants such as Claude Code and Cursor. You connect Spaicely to your AI once. You sign in with your email address, a passkey or your Google, Apple or Microsoft account.

### Do I need to be technical?

No. You tell your AI what you want. It asks your permission before it buys anything, and you choose what else it may do on its own.

### What if I want to leave?

Your domain is in your name and your site is made of plain files. You can take everything to another provider.

### Can I keep my existing domain?

Yes. Your AI transfers it to Spaicely, or you leave it where it is and point its nameservers to us. Your email keeps working.

### Where is my data stored?

Your site is stored in Frankfurt and Stockholm and your account in Germany. Visitors get your pages quickly through servers around the world. Spaicely is a Dutch company; the privacy policy lists what may leave the EU, such as payments through Stripe.

### Can I get email on my own domain?

Yes. Keep your current email; your AI sets up the records on your domain so your mail does not end up in spam. Want info@ on your own domain? Spaicely forwards it to the inbox you already have (£1.30 per address a month, excl. VAT); real mailboxes on your domain come later.

### Can I do it without an AI?

Yes. On app.spaicely.com you create a site, upload a folder or zip, put versions live, connect your domain and set up forms. If you build with Jekyll, Hugo or Astro yourself, you publish from your terminal with the Spaicely CLI.

### I already have a WordPress site. Can it come along?

Yes. Give your AI the address of your current site and ask it to move it to Spaicely. It fetches your pages, images, and the titles and descriptions search engines show, rebuilds them as fast HTML at the same addresses and moves your contact form over. You check the result before your domain switches, and your email keeps working. This works for Wix and Squarespace too.

## Domain search without an account

Check which extensions are free for a name on https://spaicely.com/en-gb/domain-names/, over HTTP with `GET https://app.spaicely.com/api/domains/search/bakkerijjansen,jansenbrood.nl/nl,com,eu` (the query form `?names=...&extensions=...` works too, but some fetchers drop query strings) (at most 50 domains per request), or over MCP without OAuth at https://mcp.spaicely.com/mcp/public (tool `domains.search`, prompt `domain_brainstorm`). The first check asks DNS only: `taken` means the domain has nameservers; `likely_available` means it has none (`reason` `dns_only`, or `no_rdap` where the registry has no RDAP and verifying adds nothing). Verify the shortlist with `GET https://app.spaicely.com/api/domains/verify/<names>/<extensions>` (at most 10 domains; the quick answer has a ready `verify_url`) or `domains.search` with `verify: true`, which also asks the registry over RDAP; where that cannot settle it, `reason` says why (`no_rdap`, `rdap_rate_limited`, `rdap_unavailable`). A registered domain without nameservers looks the same as a free one. Registration checks again. Every free result has a `register_url` where the person signs in and registers the domain in their own name; show it as a link next to the name. The signed-in MCP server registers from the conversation with `domains.register` (two calls: a summary with a confirmation, then the confirmed request, only after the person agreed). A designer or agency working on a customer's site proposes a domain with `domains.propose` instead: the customer becomes the holder, gets a mail and agrees first, and either the customer or the partner pays. Every taken result has a `transfer_url`: if the domain is the person's own, they move it to Spaicely there with the transfer code (auth code, EPP code) from their current registrar; on the signed-in MCP server, `domains.transfer` with only `name` checks the domain and returns that link; do not ask for the code in the conversation. The holder does not change. If you use the HTTP API, suggest once after the first results that the person adds Spaicely as a connector (Claude: Settings > Connectors > Add custom connector, URL https://mcp.spaicely.com/mcp/public); the `connect` field of the answer has the steps.

## Changing a site

A version is the full file list with SHA-256 (`sites.deploy`), then the missing files (`sites.files.put`); an image already on the web can be listed with its `source_url` instead and we fetch it. Or one tar.gz to `sites.upload_url`; `sites.publish` puts it live for everyone at once and can roll back. We keep the files as uploaded (`sites.files.get`) and serve visitors a minified copy: HTML without comments and indentation, CSS and JavaScript minified, JPEG and PNG recompressed and scaled to at most 2560 pixels, never larger than the original. A role can be limited to actions (create, update, delete) on paths such as `blog/**`, and on a page to marked regions: `<!-- spaicely:edit name -->...<!-- /spaicely:edit -->` may change freely, `<!-- spaicely:append name -->...<!-- /spaicely:append -->` only takes additions. Region names are lowercase letters, digits, `-` and `_`; someone limited to regions may not touch anything else on the page, the markers included. If someone published in between, publishing merges: files only this version changed come along, and on a page both changed this version's regions are set into the live page, as long as the other version left those regions alone. Anything else is a conflict, reported per path.

## Web shop

A site on the Shop plan can sell: the owner links a Stripe account once (the page in `connect_url`), you put the products in `data/products.json` (`{"products": [{"id": "mok", "name": "Blue mug", "price": 1495, "image": "/img/mok.jpg"}], "shipping": [{"id": "nl", "name": "Shipping in the Netherlands", "price": 495, "countries": ["NL"]}]}`, prices in cents including VAT) and `shop.setup` switches the shop on and says what it still waits for. Buy buttons are plain forms, a cart posts JSON with fetch, both to `POST https://app.spaicely.com/shop/{shop_id}/checkout`; the buyer pays on Stripe Checkout, straight to the owner, and Spaicely takes 2% commission. Prices always come from the live `data/products.json`, never from the page. `shop.orders` lists the paid orders. A file holds at most 500 products. Paid forms and donations go the same way; see Forms and donations.

## Forms and donations

`scripts.enable` adds a form handled by Spaicely and returns the HTML for a page; it works on the site's own domain and its address. Kinds: `contact` mails each message to the owner (another recipient confirms by mail first); `signup` keeps a list with double opt-in (`scripts.subscribers`); `download` mails the visitor's details to the owner and gives the visitor a link to a file under `_private/`, which never goes to the CDN; `coupon` does the same with a discount code: one code for everyone, a list of codes that each go out once, or `dated_codes` with a window (a shared code per week, or unique codes that expire). A download or coupon form with `price_cents` is paid: the visitor pays the owner on Stripe and gets the link or code by mail. `donation` takes donations on every plan: amount buttons and a free amount, paid to the owner's own Stripe account, a thank-you mail to the donor and a mail per donation to the owner; donors may show their name and message. `GET https://app.spaicely.com/forms/{form_id}/progress` gives the total, the number of donors and the names shown, open to any origin, for a progress bar towards a goal. What comes in is the owner's, also when a goal is not reached; not for investments or loans. Payments carry 2% commission plus VAT.

## Accounts, plans and the dashboard

People sign in with a passkey, a link by mail, or Google, Apple or Microsoft; there are no passwords. Everything the AI does can also be done without one at https://app.spaicely.com: create a site, upload a folder or zip, put versions live, connect a domain, edit DNS records, set up forms and see visits. Every paid site also has its own address, `<label>.spaicely.site` (not indexed), to share before a domain is connected; `account.whoami` gives it. Plans: Site, for up to 3 people per site (a partner counts as one); Pro, for any number of people and approval before going live (someone who may change files but not publish asks with `sites.review.request`; whoever may publish gets a mail); Shop, Pro with a web shop of up to 500 products. `sites.stats` gives requests per day as the CDN counts them, without cookies or scripts on the site. Designers and agencies are partners: a discount of 10, 15 or 20% from 5, 15 or 40 customer sites, and 20% credit for 24 months on sites whose customer takes over the payment; `sites.handover` hands a finished site to its customer and `domains.propose` proposes a domain the customer agrees to and holds. A consumer may withdraw from hosting within 14 days of the first payment, with a button on the site's page; a domain starts right away and cannot be withdrawn.

## Building a site

Spaicely hosts what you upload, as it is; whatever a good site needs beyond its pages, you make. At the root: `index.html` (other pages as folders with their own `index.html`, linked as `/over/`), `404.html` in the style and language of the site, `robots.txt` with a `Sitemap:` line, `sitemap.xml` with every indexable page by full URL, `llms.txt` (https://llmstxt.org), `favicon.ico`, `icon.svg`, `apple-touch-icon.png` (180x180), `site.webmanifest` and an `og.jpg` of 1200x630 for link previews. On every page: `lang`, viewport, its own `<title>` and meta description, `<link rel="canonical">`, Open Graph tags (`og:title`, `og:description`, `og:url`, `og:image`, `og:locale`) and `twitter:card`, all with full `https://` URLs on the site's domain. JSON-LD on the home page with the most precise schema.org type for the business (address, opening hours, `sameAs` social profiles) plus `WebSite`; only facts the person gave, never invented. Several languages: one folder each, `hreflang` links including `x-default`, a visible language switch. Semantic HTML, `alt`, `width` and `height` on images, little JavaScript, fonts served from the site itself rather than Google Fonts. CSS, JavaScript, images and fonts stay a day in browsers, so give a changed file a new name. Forms through `scripts.enable`; no tracking without consent. After publishing, `sites.versions` reports `hints` (such as `no_sitemap`, `no_social`, `img_without_alt`), each with a `fix`. Afterwards suggest Google Search Console and Bing Webmaster Tools; their TXT verification record can be set with `domains.dns.update`. The full checklist with examples: https://spaicely.com/skills/en/site-building/SKILL.md (also nl, de, fr).

What the AI may do itself is the person's choice, per kind of action: building, publishing, domain and DNS, forms and shop, visitor data, mail, buying and plans, people and roles, the domain at the registry, deleting and billing details, each `self`, `ask` or `never` (`ai_permissions` in `account.whoami`; set at https://app.spaicely.com/ai, where account owners can also set a minimum for everyone). By default buying, people, mail, the registry, deleting and billing details are `ask`. A call of an `ask` kind does not run: it answers with `approval_required`, an `approval` id and a `url` for the person. Do not repeat it. The person approves in Spaicely with a passkey or a recent sign-in, optionally with "don't ask me again" for that kind; we then run the call exactly as it was sent, and `approvals.status` gives its answer. A request waits 24 hours.

Running a site once it is built: uploading and publishing versions, rolling back, changing one marked block of a page, connecting the domain, DNS records, mail forwarding, people and roles, approval, handover, the hosting plan and domain renewals. Step by step: https://spaicely.com/skills/en/site-management/SKILL.md (also nl, de, fr).

## Command line

The open-source Spaicely CLI (https://github.com/spaicely/cli, MIT) is an MCP client of the same server, with the same OAuth and the same rights. It suits people who build their site themselves (Jekyll, Hugo, Eleventy, Astro, plain HTML) and coding assistants that run shell commands. Install with `brew install spaicely/tap/spaicely`, `npm i -g spaicely` or `curl -fsSL https://spaicely.com/install.sh | sh`. `spaicely login` signs in through the browser; `spaicely init` writes `spaicely.toml` (site, folder, build command); `spaicely serve` shows the site locally as it will be served; `spaicely deploy` builds, shows what changes and uploads a new version; `spaicely publish` and `spaicely rollback` switch versions; `spaicely domains search <names> -e nl,com` checks names without signing in; `spaicely domains register`, `domains transfer` (opens the form in the browser, so the transfer code stays out of the terminal), `domains connect --site <n>`, `domains status`, `spaicely dns ls|add|rm` handle domains and DNS; `spaicely call <tool> '<json>'` reaches every tool. `--json` gives machine-readable output; exit code 3 means not signed in, 5 a conflict while publishing.

## MCP tools on https://mcp.spaicely.com/mcp

### account.whoami

Who am I working for?. Scope `account:read`.

Returns the person and account you act for, your scopes, and per site your role and what you may do. Call this first.


### approvals.status

Approvals the person must give. Scope `account:read`.

A call of a kind of action the person set to `ask` (see `ai_permissions` in account.whoami) does not run at once: it answers with `approval_required`, an `approval` id and a `url` for the person. Do not repeat that call. Once the person says they decided, pass the `approval` id here: `status` is pending, approved, rejected or expired, and for an approved call `result` is the answer the call gave, exactly as if it had run at once. Without an id: the approvals of this account that still wait. Needs scope account:read.

- `approval` string

### account.members

People on the account. Scope `access:manage`.

Lists the people on the account you act for, with their role (owner or member) and the open invitations. Everyone on an account works on all its sites; owners also handle payment, domains and people. For owners: `invite` mails a link, valid for 7 days, to an address (role member or owner); `set_role` with `user_id` and `role` changes a role; `remove` with `user_id` takes someone off; `cancel_invitation` with an e-mail address withdraws an invitation. People on a single site instead of the whole account: access.update. Ask the person first. Needs scope access:manage.

- `invite` string: E-mail address to invite
- `role` string (member, owner): For invite and set_role; default member
- `set_role` boolean
- `remove` boolean
- `user_id` integer: For set_role and remove, from the list
- `cancel_invitation` string: E-mail address of an open invitation

### account.billing

Billing details of the account. Scope `billing:write`.

Shows the billing details of the account you act for: whether it is a business, VAT number, address and country, and changes them with the fields you pass. They go on every invoice and decide the VAT: a business in another EU country with a VAT number that VIES confirms pays no Dutch VAT. A VAT number is checked with VIES on saving. Hosting and domains cannot be bought without them. Only owners. Needs scope billing:write.

- `business` boolean
- `vat_number` string
- `billing_street` string
- `billing_postal_code` string
- `billing_city` string
- `billing_country_code` string: Two letters, such as NL

### account.invoices

Invoices of the account. Scope `billing:write`.

Lists Spaicely's invoices to the account you act for, newest first (at most 50): number, date, amounts in euro cents and a `url` where the person reads and prints it. A credit invoice has a negative total. Only owners. Needs scope billing:write.


### domains.register

Register a domain. Scope `domains:buy`.

Registers a domain in the name of the customer account you act for; that account becomes the holder. Call it first without `confirmation`: it checks the name and the holder details and returns a summary with the price and a confirmation. Show the summary to the person and ask whether to go ahead; only then call again with the same name and that confirmation. That call returns a `payment_url`: give it to the person, who pays there; the domain is registered once the payment is in. Holder details are needed once per account (pass `contact`); later domains reuse them. A consumer (an account that is not a business) must first agree to have the order carried out at once and to lose the 14-day right of withdrawal once it is done; ask them, and pass `start_now: true` with the second call only when they said yes themselves. Without it a consumer cannot order. Automatic renewal is on by default and charges the card or direct debit used for this payment; see domains.auto_renew. Needs scope domains:buy.

- `name` string, required: The full domain, such as bakkerijjansen.nl
- `contact` object: The holder as the registry records it. Leave out to reuse the last one.
- `confirmation` string: From the first call, after the person agreed.
- `start_now` boolean: Required for consumers, with the second call: carry out the order at once and give up the 14 days to withdraw. Only when the person said so themselves.

### domains.propose

Propose a domain to the customer. Scope `domains:buy`.

For a partner working on a customer's site (as admin, maintainer or designer): proposes a domain for that site. The customer becomes the holder and gets a mail with a link, valid for 14 days, to check the holder details and agree; nothing is ordered before that. `payer` is `customer` (the customer pays when agreeing) or `partner` (an owner of the partner account pays afterwards, on the page in `proposal_url`). `contact` fills in the holder details for the customer to check; leave it out to let the customer fill them in. Ask the person first. Needs scope domains:buy.

- `site_id` integer, required
- `name` string, required: The full domain, such as bakkerijjansen.nl
- `payer` string (customer, partner)
- `contact` object: The holder (the customer) as the registry records it; optional.

### domains.transfer

Move a domain to Spaicely. Scope `domains:buy`.

Moves a domain that is registered elsewhere to Spaicely, in the name of the customer account you act for; that account is the holder. The person gets the transfer code (also called auth code, EPP code or token) from their current registrar and must unlock the domain there. Do not ask for the code in the conversation: call with only `name`. That checks whether the domain can move and returns a `url` where the person signs in, enters the code and the holder details and confirms; give them that link. domains.status shows the move afterwards. Only when the person pastes the code into the conversation themselves: call with `name` and `transfer_code` and without `confirmation` for a summary and a confirmation, ask the person, then call again with the same name, the same transfer_code and that confirmation; that call returns a `payment_url` for the person, and the move starts once the payment is in. A consumer must agree to `start_now` first (see domains.register). Automatic renewal is on by default (domains.auto_renew). Needs scope domains:buy.

- `name` string, required: The full domain, such as bakkerijjansen.nl
- `transfer_code` string: Only when the person gave it in the conversation themselves
- `contact` object: The holder as the registry records it. Leave out to reuse the last one.
- `confirmation` string: From the first call, after the person agreed.
- `start_now` boolean: Required for consumers, with the second call: carry out the order at once and give up the 14 days to withdraw. Only when the person said so themselves.

### domains.auto_renew

Automatic renewal of a domain. Scope `domains:buy`.

Shows whether a domain held by the account you act for renews automatically, and switches it on or off with `on`. Automatic renewal is on by default: Spaicely charges the card or SEPA direct debit the domain was paid with, 14 days before the expiry date, and e-mails the amount beforehand. When no payment method is saved, the answer has a `setup_url`: give it to the person, who saves a card or mandate at Stripe there. Leave `on` out to only look. A consumer (an account that is not a business) who switches it on must agree that each renewal is carried out at once, without the 14-day right of withdrawal; pass `start_now: true` only when they said so themselves. Only owners of the holder account can change it. Needs scope domains:buy.

- `domain` string, required: The full domain, such as bakkerijjansen.nl
- `on` boolean: true to switch on, false to switch off; leave out to only look.
- `start_now` boolean: For consumers switching it on: renewals start at once, without the right of withdrawal.

### domains.renew

Renew a domain now. Scope `domains:buy`.

Gives a link where the person pays for the renewal of a domain registered through Spaicely now, instead of waiting for automatic renewal (domains.auto_renew); the domain renews after payment, for the period in the answer. A consumer (an account that is not a business) must agree that the renewal is carried out at once, without the 14-day right of withdrawal; pass `start_now: true` only when they said so themselves. Only owners of the holding account. Needs scope domains:buy.

- `domain` string, required
- `start_now` boolean

### domains.holder

Holder of a domain. Scope `domains:buy`.

Shows the holder of a domain registered through Spaicely, as the registry knows it, and changes it with the fields you pass. Address, phone and e-mail go to the registry at once, for every domain on the same holder record (shared_with lists them). Another name or organisation is a change of holder: Spaicely staff handle it, which can take a few working days. The holder is the legal owner of the domain: change it only with the person's own details or what they said. Only owners of the holding account. Needs scope domains:buy.

- `domain` string, required
- `name` string
- `organization` string
- `email` string
- `phone` string
- `street` string
- `postal_code` string
- `city` string
- `country_code` string (NL, BE, DE, FR, AT, CH, LU, GB, IE, IT, ES, PT, DK, SE, NO, FI, PL, CZ, US)

### domains.lock

Transfer lock of a domain. Scope `domains:buy`.

Switches the transfer lock of a domain registered through Spaicely on or off. With the lock on, nobody can move the domain to another provider, even with the transfer code. Switch it off only when the person moves the domain away; domains.status shows the lock. Only owners of the holding account. Needs scope domains:buy.

- `domain` string, required
- `locked` boolean, required

### domains.nameservers

Nameservers of a domain. Scope `domains:buy`.

Sets the nameservers of a domain registered through Spaicely. `ours: true` puts back Spaicely's own (needed for a site and for mail forwarding). Other nameservers (2 to 13) only for a domain that is not on a site, for instance when the person keeps their DNS elsewhere; Spaicely's DNS then no longer applies. Ask the person first. Only owners of the holding account. Needs scope domains:buy.

- `domain` string, required
- `ours` boolean
- `nameservers` array of string: Host names, such as ns1.example.net

### domains.transfer_code

Transfer code of a domain. Scope `domains:buy`.

Asks for the transfer code (auth code) of a domain registered through Spaicely, to move it to another provider. The code goes by mail to the person and the holder, not to you; every new request makes the earlier code useless, so ask at most a few times an hour. The transfer lock must be off at the moment of the move (domains.lock). Ask the person first. Only owners of the holding account. Needs scope domains:buy.

- `domain` string, required

### sites.create

Create a site. Scope `content:write`.

Makes a new, empty site on the account you act for, owned and paid for by that account. Then sites.deploy and sites.publish put the first version on it, and sites.domains.connect puts it on the person's domain. Ask the person for the name first. Needs scope content:write and the role owner or member of a customer account. A site needs a hosting subscription: without one it is removed after 14 days; tell the person and give them the subscription_url from the answer. Once paid and published, the site also answers on its address (<label>.spaicely.site, in the answer), to share before a domain is connected; search engines are told to skip it.

- `name` string, required: Name of the site as the person calls it

### sites.update

Rename a site. Scope `access:manage`.

Gives a site another name, at most 80 characters. The name is only for the person and the people they work with; visitors never see it. Needs scope access:manage and the role owner or admin.

- `site_id` integer, required
- `name` string, required

### sites.delete

Delete a site. Scope `access:manage`.

Deletes a site for good: it goes offline at once, and every version, form and the shop disappear. The hosting stops without a refund for the current month; a consumer who can still withdraw should do that first (sites.subscription shows withdrawable). Connected domains stay the person's, with their DNS and mail. This cannot be undone: tell the person exactly what goes, and pass `confirm_name` only as the site name they typed or said themselves. Only owners of the site. Needs scope access:manage.

- `site_id` integer, required
- `confirm_name` string, required: The name of the site, as the person confirmed it

### sites.subscription

Hosting plan of a site. Scope `billing:write`.

Shows the hosting plan of a site: plan, status, the date it renews or ends, the paying account, and whether a consumer can still withdraw. Pass `plan` (site, pro or shop) to start hosting when the site has none: the answer has a `checkout_url` where the person pays at Stripe; give it to them. On a site that has a plan, `plan` switches to it straight away; Stripe settles the rest of the month on the next invoice. Card, invoices and cancelling are at `portal_url`. A consumer (an account that is not a business) who starts hosting must agree that it starts at once, which limits the right of withdrawal to the unused days; pass `start_now: true` only when they said so themselves. Ask the person before you start or switch a plan. Only owners of the paying account. Needs scope billing:write.

- `site_id` integer, required
- `plan` string (site, pro, shop): Start this plan, or switch to it; leave out to only look. Site EUR 9, Pro EUR 19, Shop EUR 39 a month excl. VAT (GBP 8/17/34 in the United Kingdom, USD 11/22/45 outside Europe).
- `start_now` boolean: For consumers starting a plan: hosting starts at once.

### sites.versions

List the versions of a site. Scope `sites:read`.

Lists the versions (deployments) of a site, newest first: number, status (draft, ready, publishing, live, failed), files and who made it. Needs scope sites:read.

- `site_id` integer, required

### sites.deploy

Start a new version of a site. Scope `content:write`.

Starts a new version of a site. Pass every file of the finished site (not only the changed ones) with its path from the site root, its SHA-256 in hex and its size in bytes. For an image (or any file) that is already on the web, pass source_url instead of sha256 and size: we fetch it (https, at most 20 per call, 25 MB each), so you need not send it as base64; use only images the person may use. The answer lists `missing`: send exactly those with sites.files.put. Has the site as a folder on disk? Use sites.upload_url instead. A version goes live only with sites.publish. Needs scope content:write; your role decides which paths you may change.

- `site_id` integer, required
- `files` array of object, required

### sites.files.put

Send files for a new version. Scope `content:write`.

Sends the contents of files that sites.deploy listed as missing, at most 50 files and 2 MB per call. Text files as encoding utf8, images and other binary files as base64. The contents must match the SHA-256 you listed. The answer says which files are still missing. Needs scope content:write.

- `site_id` integer, required
- `deployment` integer, required: The number sites.deploy returned
- `files` array of object, required

### sites.upload_url

Get an upload address for a whole site. Scope `content:write`.

Returns a one-time URL, valid 10 minutes, that takes the finished site as one tar.gz archive with index.html at its root. Upload with `tar -czf site.tar.gz -C <folder> . && curl -T site.tar.gz <url>`; the answer to that request is the new version. Then call sites.publish. Needs scope content:write.

- `site_id` integer, required

### sites.publish

Put a version of a site live. Scope `sites:publish`.

Puts a ready version live; visitors switch over at once, never to a mix of two versions. Pass `deployment`, or `rollback: true` to bring back the version that was live before. It takes up to half a minute; sites.versions shows when it is live, with a report whose `hints` say what the site still lacks (sitemap, social tags, alt texts...), each with a `fix`. If someone published after your version was started, your changes are merged onto theirs and that merge goes live; a conflict comes back per path. Ask the person before you publish. Needs scope sites:publish and a role that may publish.

- `site_id` integer, required
- `deployment` integer
- `rollback` boolean

### sites.review.request

Ask for approval of a version. Scope `content:write`.

For a person who may change files but not publish (sites.publish refuses them): asks the people who may publish to approve a ready version. They get a mail and put it live from the dashboard or with sites.publish, or turn it down with a note; sites.versions shows the state under `review`. Pass a short `note` on what changed. Only on plan Pro and Winkel; on plan Site the person asks someone who may publish. Needs scope content:write.

- `site_id` integer, required
- `deployment` integer, required
- `note` string

### sites.review.reject

Send a version back. Scope `sites:publish`.

Sends back a version someone asked approval for with sites.review.request, with a `note` that tells them what to change; they get it by mail. To approve, publish the version with sites.publish. Ask the person first. Needs scope sites:publish and a role that may publish.

- `site_id` integer, required
- `deployment` integer, required
- `note` string: What should change, for whoever asked

### sites.files.list

List the files of a site. Scope `sites:read`.

Lists the files of the live version of a site, or of `deployment`: path, SHA-256 and size. HTML pages also list their regions, the blocks marked <!-- spaicely:edit name --> or <!-- spaicely:append name --> that a role can be limited to. Pass `prefix` to list one folder. Fetch contents with sites.files.get. Needs scope sites:read.

- `site_id` integer, required
- `deployment` integer
- `prefix` string: Such as blog/

### sites.files.get

Read files of a site. Scope `sites:read`.

Returns the contents of up to 20 files (1 MB together) of the live version of a site, or of `deployment`, exactly as they were uploaded. Text files come back as utf8, others as base64. Read a page before you change it, so you keep what others made. Needs scope sites:read.

- `site_id` integer, required
- `deployment` integer
- `paths` array of string, required

### sites.region.update

Change one region of a page. Scope `content:write`.

Makes a new version that differs from the live one in one region of one page: the block between <!-- spaicely:edit name --> and <!-- /spaicely:edit --> (or spaicely:append). `mode` replace (the default) swaps the contents, prepend or append adds HTML before or after them; an append region only takes prepend or append. `index` picks the region when a page has several with the same name (0 is the first). sites.files.list shows the regions. Then ask the person and call sites.publish. Needs scope content:write.

- `site_id` integer, required
- `path` string, required: Such as index.html
- `region` string, required
- `content` string, required: HTML
- `mode` string (replace, prepend, append)
- `index` integer

### sites.stats

Visits of a site. Scope `sites:read`.

How much a published site is visited, per day over the last 7, 30 or 90 `days` (default 30), counted by the CDN without cookies or scripts on the site, in total and in `per_day`: `requests` (every file served: pages, images, styles; not people), `bytes` sent, `not_found` (addresses that do not exist, a hint at broken links) and the CDN `regions` that served them, close to the visitors. Needs scope sites:read.

- `site_id` integer, required
- `days` integer (7, 30, 90)

### sites.domains.connect

Put a site on its domain. Scope `dns:write`.

Connects a domain to a site, so the site answers on https://<domain> and www sends people on to it. Spaicely runs the DNS of every domain it hosts. Call it with the domain itself (no www): Spaicely first looks up the records the domain has now (mail, verifications); call again after about half a minute to get them in records_to_confirm. Show those to the person: kept records come along so mail keeps working, records with reason site are replaced by the website, reason certificate means a CAA record that would block the certificate. Then call with confirm: true (and skip with the index of records to leave out). After that the person sets the nameservers at their registrar to the two in the answer; domains we registered already have them. We check every five minutes, then get the certificate and mail the person. domains.status shows the state at any time. Needs scope dns:write and a role that may change DNS.

- `site_id` integer, required
- `domain` string, required: Such as bakkerijjansen.nl
- `confirm` boolean: After the person agreed to the records in records_to_confirm.
- `skip` array of integer: Indexes of found records to leave out.

### sites.domains.disconnect

Take a site off a domain. Scope `dns:write`.

The site stops answering on the domain and on its www. Other records, such as mail, stay in Spaicely's DNS as long as the nameservers point at us. Ask the person first. Needs scope dns:write and a role that may change DNS.

- `domain` string, required

### domains.status

How is a domain doing?. Scope `domains:read`.

Shows whether a domain is connected to its site, what is still needed (records to confirm, nameservers at the registrar, DNSSEC to switch off, the certificate) and the DNS records Spaicely serves for it. current_nameservers is what the registry says now. For a domain of the account that is on no site, it shows the registry side instead: expiry, automatic renewal, transfer lock, nameservers, and the DNS records when Spaicely's DNS serves it. Needs scope domains:read.

- `domain` string, required

### domains.dns.update

Change DNS records. Scope `dns:write`.

Adds or deletes DNS records of a domain that is connected to a site, or of a domain of the account on no site (one registered through Spaicely then gets Spaicely DNS, which only answers once its nameservers are ours), such as MX and TXT for mail or a CNAME for a service on a subdomain. Types: A, AAAA, CNAME, TXT, MX, SRV, CAA. name is relative to the domain (empty or @ for the domain itself). Where the domain itself and www point stays with the site. delete takes record ids from domains.status. Ask the person first. Needs scope dns:write and a role that may change DNS.

- `domain` string, required
- `add` array of object
- `delete` array of integer

### mail.forward.status

Mail forwarding of a domain. Scope `mail:write`.

Whether mail to a domain connected to a site is forwarded, its addresses (info@, or * for every address) and where each goes, with the state of each destination (pending until the address clicked the confirmation link we mailed it), and the mail held back in the last 30 days as possible spam (subject, sender, reason, id for mail.forward.release). Every address costs EUR 1.50 (GBP 1.30, USD 1.75) a month excl. VAT on the site's plan; Site allows 1, Pro 5, Shop 10. Needs scope mail:write and the owner or admin role.

- `domain` string, required

### mail.forward.enable

Switch on mail forwarding. Scope `mail:write`.

Lets Spaicely receive the mail of a domain connected to a paid site, so its addresses can be forwarded to mailboxes the person already has (mail.forward.add). Sets the records in Spaicely's DNS: MX to relay-mx.spaicely.net, a verification TXT, DKIM, the SPF include and DMARC if missing. When the domain already receives mail elsewhere (an MX of its own), that stops: the call refuses unless replace_existing_mail is true, so ask the person first. Spam and doubtful mail is held back, not forwarded. Needs scope mail:write and the owner or admin role.

- `domain` string, required
- `replace_existing_mail` boolean

### mail.forward.disable

Switch off mail forwarding. Scope `mail:write`.

Stops forwarding for a domain: its addresses go, held-back mail is deleted, the MX and the other forwarding records leave Spaicely's DNS and the addresses are no longer billed. Mail to the domain is refused until it gets an MX elsewhere. Ask the person first. Needs scope mail:write and the owner or admin role.

- `domain` string, required

### mail.forward.add

Forward an address. Scope `mail:write`.

Forwards an address of the domain (address: the part before the @, such as info, or * for every address without one of its own) to up to 5 mailboxes. Each new destination gets a mail from Spaicely with a link; nothing is forwarded there until it is clicked. Called again for an address that exists, it adds destinations. Each address costs EUR 1.50 (GBP 1.30, USD 1.75) a month excl. VAT on the site's plan, prorated; Site allows 1, Pro 5, Shop 10. Ask the person first. Needs mail.forward.enable before, scope mail:write and the owner or admin role.

- `domain` string, required
- `address` string, required
- `destinations` array of string, required

### mail.forward.remove

Stop forwarding an address. Scope `mail:write`.

Removes a forwarded address of the domain (address: info, or *), or with destination only that one mailbox. Mail to a removed address is refused, unless * forwards it. The address is no longer billed. Ask the person first. Needs scope mail:write and the owner or admin role.

- `domain` string, required
- `address` string, required
- `destination` string

### mail.forward.release

Forward held-back mail. Scope `mail:write`.

Sends a message that was held back as possible spam on to its destinations after all (id from mail.forward.status). Only when the person recognises it as real mail; never for mail held as spam or scam unless they insist. Needs scope mail:write and the owner or admin role.

- `domain` string, required
- `message_id` string, required

### scripts.list

List the forms of a site. Scope `sites:read`.

Lists the forms (scripts) of a site: form_id, kind (contact, signup, download or coupon), status (active, waiting_for_recipient, waiting_for_file, waiting_for_codes, disabled), the endpoint on scripts.spaicely.com, counts (for coupon: codes left and given out) and the HTML to put in a page. Needs scope sites:read.

- `site_id` integer, required

### scripts.enable

Add a form to a site. Scope `scripts:write`.

Adds a form to a site, handled by Spaicely on https://scripts.spaicely.com. kind contact mails every message to `recipient` (by default the person's own address); another address must confirm once by mail. kind signup keeps a list with double opt-in: the visitor confirms by mail, scripts.subscribers gives the list. kind download mails what a visitor fills in to `recipient` and gives the visitor a link to `file_path`, a file you deploy under _private/ (never on the CDN, so the form is the only way to it); see `delivery`. kind coupon does the same with a discount code: `coupon_code` for one code for everyone, `coupon_codes` for codes that each go out once, or `dated_codes` for codes with a window (a shared code per week, or unique codes that expire). With `price_cents` a download or coupon form is paid: the visitor pays on Stripe to the site owner and gets the link or code by mail. kind donation takes donations for the site owner on every plan: amount buttons and a free amount, paid on Stripe to the owner's own account (2% commission), a thank-you mail to the donor and a mail per donation to `recipient`; donors may show their name and message. `progress_url` in the answer gives the total, the number of donors and the names shown, as JSON open to any origin, for a progress bar towards `goal_cents`. Keep what you raise: no money goes back when a goal is not reached. Not for investments or loans. The answer has `html`: put that form in a page as it is and style it with the site's CSS; you may add fields (any name, not starting with _), the field email becomes the reply address. The form only works on the site's connected domain. Needs scope scripts:write and the role owner, admin or maintainer.

- `site_id` integer, required
- `kind` string (contact, signup, download, coupon, donation), required
- `name` string, required: What the person calls the form, such as Contact
- `recipient` string: contact, download and coupon: the address that gets the messages
- `locale` string (nl, en, de, fr): Language of the mails and our pages
- `subject` string: contact: subject of the mail
- `success_url` string: Page on the site's own domain to show after sending
- `confirmed_url` string: signup: page on the site's own domain after confirming
- `file_path` string: download: the file in the site that visitors get, under _private/ (such as _private/guide.pdf); deploy it like any other file, it never goes to the CDN
- `delivery` string (mail, direct): download and coupon: mail (default) sends the link or code to the address filled in, which shows it is real; direct starts the download or shows the code right after sending (coupon: only codes everyone gets, coupon_code or shared codes; a paid form always mails)
- `keep_leads` boolean: contact, download and coupon (free forms): also keep what visitors send, besides the mail, so the owner sees and exports it in the dashboard (scripts.leads). Off by default; kept leads go after a year
- `coupon_code` string: coupon: one code every visitor gets, such as WELCOME10
- `coupon_codes` array of string: coupon: codes that each go out once, added to the list (letters, digits, - and _, at most 40 characters); the recipient hears when 10 are left
- `dated_codes` array of object: coupon: codes with a window, added to the list. shared true: everyone who asks during the window gets this code (a code per week, such as WEEK45 from 2026-11-03 to 2026-11-09); otherwise each goes out once and the mail says until when it is valid. Dates without a time are whole days in Dutch time. A shared code valid now goes before the unique codes, those before coupon_code
- `clear_coupons` boolean: coupon: drop the codes not given out yet (and the shared ones) before adding
- `price_cents` integer: download and coupon: price in cents including VAT (995 = EUR 9.95, at least 50); 0 makes the form free again. A paid form posts to our checkout: the visitor pays on Stripe, to the site owner's own Stripe account as in the web shop (plan Shop, 2% commission), and gets the link or code by mail after paying. The form asks the visitor to agree to delivery right away, which ends the right of withdrawal
- `donation_amounts` array of integer: donation: the amount buttons in cents (1000 = EUR 10); the visitor may also type an amount. Empty gives 10, 25 and 50 euros
- `donation_min_cents` integer: donation: lowest amount in cents (default 100, at least 50; 0 = default)
- `donation_max_cents` integer: donation: highest amount in cents (default and at most 1000000; 0 = default)
- `goal_cents` integer: donation: the goal in cents for a progress bar; 0 removes it
- `ends_at` string: donation: last day (2026-12-31, whole day in Dutch time) or ISO 8601 time; after it the form takes no more donations. Empty removes the end

### scripts.configure

Change a form. Scope `scripts:write`.

Changes a form made with scripts.enable: only the settings you pass. `enabled` false switches it off (visitors then get an error), true switches it on again. A new recipient must confirm by mail first. For a coupon form, coupon_codes and dated_codes add codes to its list. price_cents sets or (with 0) removes a price; a paid form gets a new endpoint, so put the new `html` in the page. Needs scope scripts:write and the role owner, admin or maintainer.

- `site_id` integer, required
- `form_id` string, required
- `enabled` boolean
- `name` string: What the person calls the form, such as Contact
- `recipient` string: contact, download and coupon: the address that gets the messages
- `locale` string (nl, en, de, fr): Language of the mails and our pages
- `subject` string: contact: subject of the mail
- `success_url` string: Page on the site's own domain to show after sending
- `confirmed_url` string: signup: page on the site's own domain after confirming
- `file_path` string: download: the file in the site that visitors get, under _private/ (such as _private/guide.pdf); deploy it like any other file, it never goes to the CDN
- `delivery` string (mail, direct): download and coupon: mail (default) sends the link or code to the address filled in, which shows it is real; direct starts the download or shows the code right after sending (coupon: only codes everyone gets, coupon_code or shared codes; a paid form always mails)
- `keep_leads` boolean: contact, download and coupon (free forms): also keep what visitors send, besides the mail, so the owner sees and exports it in the dashboard (scripts.leads). Off by default; kept leads go after a year
- `coupon_code` string: coupon: one code every visitor gets, such as WELCOME10
- `coupon_codes` array of string: coupon: codes that each go out once, added to the list (letters, digits, - and _, at most 40 characters); the recipient hears when 10 are left
- `dated_codes` array of object: coupon: codes with a window, added to the list. shared true: everyone who asks during the window gets this code (a code per week, such as WEEK45 from 2026-11-03 to 2026-11-09); otherwise each goes out once and the mail says until when it is valid. Dates without a time are whole days in Dutch time. A shared code valid now goes before the unique codes, those before coupon_code
- `clear_coupons` boolean: coupon: drop the codes not given out yet (and the shared ones) before adding
- `price_cents` integer: download and coupon: price in cents including VAT (995 = EUR 9.95, at least 50); 0 makes the form free again. A paid form posts to our checkout: the visitor pays on Stripe, to the site owner's own Stripe account as in the web shop (plan Shop, 2% commission), and gets the link or code by mail after paying. The form asks the visitor to agree to delivery right away, which ends the right of withdrawal
- `donation_amounts` array of integer: donation: the amount buttons in cents (1000 = EUR 10); the visitor may also type an amount. Empty gives 10, 25 and 50 euros
- `donation_min_cents` integer: donation: lowest amount in cents (default 100, at least 50; 0 = default)
- `donation_max_cents` integer: donation: highest amount in cents (default and at most 1000000; 0 = default)
- `goal_cents` integer: donation: the goal in cents for a progress bar; 0 removes it
- `ends_at` string: donation: last day (2026-12-31, whole day in Dutch time) or ISO 8601 time; after it the form takes no more donations. Empty removes the end

### scripts.subscribers

List the subscribers of a signup form. Scope `scripts:write`.

Lists who signed up with a signup form: email, name, when they signed up and confirmed, and an unsubscribe_url to put in every mail sent to them. Only confirmed people who did not unsubscribe, unless all is true. Needs scope scripts:write and the role owner, admin or maintainer.

- `site_id` integer, required
- `form_id` string, required
- `all` boolean

### scripts.subscribers.update

Unsubscribe or remove a subscriber. Scope `scripts:write`.

For a signup form: `action` unsubscribe keeps the address on the list as unsubscribed, so it gets no more mail; remove erases everything about them, for instance when they ask to be forgotten. Ask the person first. Needs scope scripts:write and the role owner, admin or maintainer.

- `site_id` integer, required
- `form_id` string, required
- `email` string, required
- `action` string (unsubscribe, remove), required

### scripts.leads

List the leads of a form. Scope `scripts:write`.

Lists what visitors sent through a contact, download or coupon form that keeps leads (keep_leads true in scripts.configure): when, the fields in the order of the form, the page and the code a coupon form gave. Newest first, at most 500; `before` (an id) pages back. Leads go after a year. Needs scope scripts:write and the role owner, admin or maintainer.

- `site_id` integer, required
- `form_id` string, required
- `before` integer: Only leads older than this id

### scripts.leads.remove

Remove leads. Scope `scripts:write`.

Removes leads a form kept (scripts.leads): the ones in `ids`, or every lead with `all: true`, for instance when a visitor asks to be forgotten. The mails already sent stay where they are. This cannot be undone: ask the person first. Needs scope scripts:write and the role owner, admin or maintainer.

- `site_id` integer, required
- `form_id` string, required
- `ids` array of integer: Lead ids from scripts.leads
- `all` boolean

### scripts.remove

Remove a form. Scope `scripts:write`.

Removes a form made with scripts.enable, with everything it kept: signups, leads and codes. Visitors who still post to it get an error, so take the form out of the pages first. To stop it for a while, use scripts.configure with enabled false instead. This cannot be undone: ask the person first. Needs scope scripts:write and the role owner, admin or maintainer.

- `site_id` integer, required
- `form_id` string, required

### shop.setup

Set up the shop checkout of a site. Scope `scripts:write`.

Sets up checkout for a web shop on a site with the Shop plan. Payments go through Stripe Checkout on the site owner's own Stripe account, so the owner is the seller; Spaicely keeps a commission (commission_percent). Products and prices come from a JSON file in the live version of the site (`products_path`, default data/products.json): {"products":[{"id":"mug-blue","name":"Blue mug","price":1495,"description":"...","image":"/img/mug.jpg"}],"shipping":[{"id":"nl","name":"Shipping in the Netherlands","price":495,"countries":["NL"]}]} with prices in cents including VAT; shipping is optional. Keep the cart in the browser (localStorage) and POST {items:[{id,quantity}], shipping} as JSON to `endpoint` with fetch, then go to the `url` in the answer; or use the form in `html` as a buy button. Only the site's connected domain and its address may post. `status` says what is missing: waiting_for_plan, waiting_for_billing_details, waiting_for_stripe (give the person `connect_url`, where they make a Stripe account or link the one they have; `stripe_needs` says what Stripe still asks of them), waiting_for_products (see `problems`), or active. Call again after publishing the products file. Needs scope scripts:write and the role owner, admin or maintainer.

- `site_id` integer, required
- `products_path` string: Path of the products file in the site, default data/products.json
- `success_url` string: https page on the site's own domain after paying
- `cancel_url` string: https page on the site's own domain when the buyer goes back
- `locale` string (nl, en, de, fr): Language of Stripe Checkout and the order mails
- `notify_email` string: Where order mails go; default the owners of the account
- `enabled` boolean

### shop.orders

List the orders of a site's shop. Scope `sites:read`.

Lists the latest paid orders (at most 50) of the shop of a site: when, buyer name and email, shipping address, lines, total in cents and Spaicely's commission. Refunds and payouts are in the owner's own Stripe dashboard. Needs scope sites:read; the buyer's details only for the role owner, admin or maintainer.

- `site_id` integer, required

### access.list

List who works on a site. Scope `sites:read`.

Lists the owner account, the paying account and everyone with a role on a site: people (name, email) and partner accounts, with role, whether they may publish and their file rules (ADR 0006: actions on glob paths, optionally limited to marked regions). Also open handovers. Roles: admin, maintainer, designer, editor, viewer. Needs scope sites:read.

- `site_id` integer, required

### access.update

Give someone a role on a site, change it or take it away. Scope `access:manage`.

Gives a person a role on a site, changes it, or with role `none` takes them off. The person needs a Spaicely account with that email address; otherwise ask them to make one at app.spaicely.com. Roles: admin (everything but owner matters), maintainer, designer, editor, viewer. `can_publish` lets a maintainer or editor publish. `rules` limits a designer or editor to files, as in ADR 0006: [{"actions": ["create","update","delete"], "paths": ["blog/**"], "regions": ["news"]}]; regions are blocks marked <!-- spaicely:edit news --> in HTML. Ask the person first. Only the owner may do this. Needs scope access:manage.

- `site_id` integer, required
- `email` string, required
- `role` string (admin, maintainer, designer, editor, viewer, none), required
- `can_publish` boolean
- `rules` array of object

### sites.handover

Hand a site over to the customer. Scope `partner:manage`.

For a partner account that owns a site: mails the customer a link, valid for 14 days, to take the site onto their own account. `role` is what the partner keeps afterwards (the customer may narrow it or drop it; omit it to stop working on the site); `payer` is `customer` or `partner`. The site moves only when the customer accepts. Ask the person first. Needs scope partner:manage.

- `site_id` integer, required
- `email` string, required
- `role` string (admin, maintainer, designer, editor, viewer)
- `payer` string (customer, partner)

### sites.handover.revoke

Take back a handover. Scope `partner:manage`.

Takes back a handover sent with sites.handover that the customer has not accepted yet: the link in their mail stops working and the site stays with the partner. Needs scope partner:manage.

- `site_id` integer, required

## HTTP API

### GET https://app.spaicely.com/api/domains/search/{names}/{extensions}

Authentication: none.

Quick check (DNS only) whether domains are free: comma-separated names or full domains, then optional extensions, at most 50 domains. The query form ?names=&extensions= works too. Answers status per domain (taken, likely_available with a reason, unknown, invalid, unsupported), a register_url or transfer_url, and a verify_url for the deep check. CORS open; 30 requests a minute and 300 an hour per IP address.

### GET https://app.spaicely.com/api/domains/verify/{names}/{extensions}

Authentication: none.

Deep check of at most 10 domains: DNS, then our registrar (checked_via registrar) or else the registry over RDAP. Answers available or taken where one answers, otherwise likely_available with reason rdap_rate_limited, rdap_unavailable or no_rdap. A premium name has premium: true and price: our price in euro cents before VAT for the extension's term.

### GET https://app.spaicely.com/api/domains/extensions

Authentication: none.

The extensions people ask for most (extensions, the default for a bare name), all 718 Spaicely sells (all), the most domains per request, and which extensions a deep check can settle (verifiable), and a price class per extension (price_classes: 0 cheap to 4 dear), and our prices (prices: per extension create, renew and transfer in euro cents before VAT, each for the whole term paid up front: months for create, renew_months and transfer_months, 12 for most and 24 for .ai; transfer_months null means a move adds no term, as for .nl, and then often costs nothing; add VAT where it applies), and euro_rates: euros per GBP and per USD, the rate at which an account in the United Kingdom (pounds) or outside Europe (dollars) pays those prices.

### PUT https://app.spaicely.com/uploads/{token}

Authentication: one-time URL.

Upload a whole site as one tar or tar.gz (index.html at the root, plain files only, at most 200 MB) to the URL that sites.upload_url returned. It works once, for 10 minutes. POST works too. The answer is the new version; put it live with sites.publish.

### POST https://scripts.spaicely.com/f/{form_id}

Authentication: Origin: the site's connected domain.

A contact form made with scripts.enable posts here: urlencoded from a plain HTML form, or JSON with fetch. Every field not starting with _ goes to the confirmed recipient by mail; the field email becomes the reply address; _hp is the honeypot and must stay empty. A plain form gets a redirect to success_url or a page of ours, a JSON request gets {"ok": true} or {"ok": false, "error": ...} (unknown_form, origin_not_allowed, form_inactive, invalid, rate_limited, failed). At most 30 fields, 64 KB; 10 posts per visitor per 10 minutes and 100 per form per hour.

### POST https://scripts.spaicely.com/s/{form_id}

Authentication: Origin: the site's connected domain.

A signup form made with scripts.enable posts here, with email and optionally name. The visitor gets a mail to confirm (double opt-in); confirmed_url is where the link ends. The answer is the same whether the address was on the list or not. scripts.subscribers gives the list with an unsubscribe_url each.

### POST https://scripts.spaicely.com/l/{form_id}

Authentication: Origin: the site's connected domain.

A download form made with scripts.enable posts here, with email and any other fields. Everything not starting with _ goes to the confirmed recipient by mail, as with a contact form, and the visitor gets a link to the form's file_path (under _private/, never on the CDN). delivery mail: the link goes to the address filled in, works 7 days, and a plain form gets success_url or a page of ours; delivery direct: a plain form is redirected to the link, a JSON request gets {"ok": true, "download_url": ...} to open, and the link works for an hour. A link works at most 5 times.

### POST https://scripts.spaicely.com/k/{form_id}

Authentication: Origin: the site's connected domain.

A coupon form made with scripts.enable posts here, with email and any other fields. Everything not starting with _ goes to the confirmed recipient by mail, with the code the visitor got. The form has one code for everyone (coupon_code) and/or a list (coupon_codes, dated_codes): a shared code valid now goes first, then unique codes valid now (each once; the mail says until when it is valid), then coupon_code. delivery mail: the code goes to the address filled in, and a plain form gets success_url or a page of ours; delivery direct (only codes everyone gets): a JSON request gets {"ok": true, "code": ...}, a plain form a page with the code. The recipient gets a mail when 10 unique codes are left and when they ran out; without a code valid now the form answers as not active. A paid form does not post here but to /forms/{form_id}/checkout.

### GET https://{site domain}/_download/{token}

Authentication: the link from a download form.

The link a visitor gets from a download form, on the site's own domain; it never shows where the file lives. It shows a page that asks for the file by itself (so a mail scanner opening the link uses up nothing) and sends the file from the live version of the site, under its own name and type. Expired, used up, or the file no longer live: 404. A site cannot have files under _download/.

### POST https://app.spaicely.com/forms/{form_id}/checkout

Authentication: Origin: the site's connected domain or its address.

A download or coupon form with price_cents posts here instead of to the scripts service: a plain form (urlencoded) or fetch as JSON with email, start_now and any other fields. start_now must be 1: the visitor agrees to delivery right away, which ends the right of withdrawal for digital content. A form is redirected (303) to Stripe Checkout, JSON gets {"url": ...}. The visitor pays the site owner's Stripe account (2% commission, as the web shop); after paying the link or code goes to the address by mail and the details to the recipient. Errors: {"error": ..., "message": ...} with invalid_email, start_now_required, not_ready, origin (403) or too_many. A donation form posts here too, without start_now but with amount (one of its buttons, in euros) or amount_other (typed, "12,50" or "12.50"), optional name and message, and show_name 1 to show name and message on the site; an amount outside its range gives the error amount. The donor gets a thank-you mail, the recipient one per donation.

### GET https://app.spaicely.com/forms/{form_id}/progress

Authentication: none, open to every origin.

What a donation form raised, for a progress bar on the site: {"raised_cents", "donors", "goal_cents", "ends_at", "open", "donations": [{"name", "message", "at"}]} with paid donations only and the last 20 names and messages donors chose to show. Cached for a minute; other forms give 404.

### POST https://app.spaicely.com/shop/{shop_id}/checkout

Authentication: Origin: the site's connected domain or its address.

A web shop made with shop.setup sends an order here, from a plain form (a buy button, urlencoded items[0][id], items[0][quantity], shipping) or with fetch as JSON {"items": [{"id": ..., "quantity": ...}], "shipping": ...}. Products and prices come from data/products.json in the live version, never from the request: at most 50 lines, 1 to 99 each; shipping is the id of a shipping option and needed when the file has any. A form is redirected (303) to Stripe Checkout, JSON gets {"url": ...} to open. Errors: {"error": ..., "message": ...} with invalid_items, invalid_shipping, shipping_required, not_ready, origin (403) or too_many (30 per visitor per 10 minutes). The buyer pays the shop owner's Stripe account; shop.orders lists the paid orders.

### POST https://mcp.spaicely.com/mcp

Authentication: OAuth 2.1 bearer.

MCP server for signed-in clients (Streamable HTTP, stateless; GET and DELETE answer 405). Without a token it answers 401 with WWW-Authenticate pointing to the protected resource metadata.

### POST https://mcp.spaicely.com/mcp/public

Authentication: none.

MCP server without an account: domains.search and the prompt domain_brainstorm.

### GET https://mcp.spaicely.com/.well-known/mcp/server-card.json

Authentication: none.

MCP server card: name, endpoints, authentication and tools. Also at /mcp/server-card.

### GET https://mcp.spaicely.com/.well-known/oauth-protected-resource/mcp

Authentication: none.

Protected resource metadata (RFC 9728) for the MCP server: which authorization server and scopes.

### GET https://app.spaicely.com/.well-known/oauth-authorization-server

Authentication: none.

Authorization server metadata (RFC 8414).

### POST https://app.spaicely.com/oauth/register

Authentication: none.

Dynamic client registration (RFC 7591). Every client is public: no secret, PKCE S256 required. Instead, a client may pass the https URL of its client ID metadata document as client_id.

### GET https://app.spaicely.com/oauth/authorize

Authentication: browser session.

Authorization code flow with PKCE S256. The person signs in and chooses the account, the sites and the scopes on the consent screen. The resource parameter, when given, must be https://mcp.spaicely.com/mcp.

### POST https://app.spaicely.com/oauth/token

Authentication: client_id + PKCE.

Exchanges the code, or a refresh token, for an access token (1 hour). Refresh tokens rotate on every use and expire after 30 days unused.

### POST https://app.spaicely.com/oauth/revoke

Authentication: client_id.

Revokes an access or refresh token (RFC 7009).

## Scopes

- `account:read`: See your name, your account and the list of your sites
- `sites:read`: View your sites, versions and previews
- `content:write`: Change files on your sites, within your role
- `sites:publish`: Put changes live and roll them back
- `scripts:write`: Set up forms, the shopping cart and other scripts
- `dns:write`: Change the DNS records of your domains
- `mail:write`: Forward the mail of your domains (paid per address per month)
- `domains:read`: Search domain names and check their status
- `domains:buy`: Register, transfer and renew domain names (always with your confirmation)
- `billing:write`: Start or change a plan (always with your confirmation)
- `access:manage`: Invite people and change or remove their role
- `partner:manage`: Hand over sites and manage clients (for web designers)
- `handover:accept`: Accept a handover from a web designer

## Company

Spaicely is a service of Vuurpijl Beheer B.V., Lagedijk 11A, 2064 KV Spaarndam, the Netherlands · Chamber of Commerce 34108141

In 1996 Roger founded VuurWerk Internet. By 1999 it was the largest and fastest-growing web hosting provider in the Benelux: 12% of all Dutch websites ran at VuurWerk. Until 2008 he ran several web hosting and domain registration companies. He knows the trade from the inside: the servers, the registries and the customer who rings on a Sunday evening because their mail isn't working.

Hosting companies still work as if it were 2001. You get a control panel such as Plesk or cPanel, a separate domain registration and a manual. It is complicated and unfriendly, and apart from the price there is hardly any difference between providers. Most sites run on WordPress, in PHP. On every visit PHP starts, connects to the database, fetches the content and puts the page together, while that page hasn't changed in months. That can be faster, safer and cheaper.

Page: https://spaicely.com/en-gb/about/

Contact: info@spaicely.com