Configuration

List Config Sections

{"data": ["system", "site", "media", "security", "info"]}

The list always starts with system and site and ends with info, which is a client-side system information tab rather than a readable scope. In between, sorted by name, come the core scopes media and security plus any site-, plugin- or theme-authored custom scopes (a user/config/<name>.yaml with a matching config blueprint). backups is included for super users only, and scheduler is never listed. Plugin and theme settings are not listed here; read them as plugins/{name} and themes/{name} scopes.

Get Config

{"data": {"title": "My Site", "author": {"name": "Admin", "email": "[email protected]"}}, "meta": {"overrides": ["title"], "fallback": {"title": "Grav"}}}

The body is the full configuration for the selected layer, recomputed from the YAML files, so reading with X-Config-Environment: default shows the base configuration even while an environment overlay is active. Passwords, API keys and tokens come back masked. meta.overrides lists the dotted leaf paths the selected layer overrides, and meta.fallback gives the value each of those would revert to (see Revert Config).

The ETag is computed from the stored overrides, not from the full body, so it stays valid across a save and reload.

Update Config

{"title": "Updated Site Title"}

{"data": {"title": "Updated Site Title", "author": {"name": "Admin", "email": "[email protected]"}}, "meta": {"overrides": ["title"], "fallback": {"title": "Grav"}}}

The request body is deep-merged into the existing configuration, using the scope's blueprint so fields such as file lists are replaced rather than merged. Only fields whose values changed are validated against the blueprint. Only the values that differ from the parent layer are written to disk, and values supplied through GRAV_CONFIG__* environment variables are never persisted. A masked secret sent back unchanged keeps its stored value.

The response has the same structure as Get Config and carries an X-Invalidates header (config:update:<scope>, plus plugins:update:<name> and plugins:list for plugin scopes). A successful save fires onAdminSave, onAdminAfterSave and onApiConfigUpdated.

Supports optimistic concurrency control via the If-Match header.

Revert Config

{"keys": ["pages.theme", "debugger.enabled"]}

{"data": {"pages": {"theme": "quark"}, "debugger": {"enabled": false}}, "meta": {"overrides": ["pages.markdown.extra"], "fallback": {"pages.markdown.extra": false}, "reverted": true}}

Reverting a key in the base layer lets the core or plugin default take over; reverting it in an environment layer lets the base value take over. If nothing remains in the layer's file after the revert, the file is removed.

The response is the effective configuration after the revert, with secrets masked, in the same structure as Get Config. meta.overrides lists the paths that still override the parent layer, and meta.reverted says whether anything on disk changed. Reverting something the layer does not override (for example reset: true when the layer has no file) still returns 200, but meta.reverted is false and onApiConfigUpdated does not fire, so no config.updated webhook is sent.

Supports optimistic concurrency control via the If-Match header, using the same ETag as Get Config.

Get Accounts Config

{"data": {"object": {"compat": {"events": true}}}}

This route takes precedence over GET /config/{scope}, so accounts is never read as a generic scope.