About HTTP Endpoints

An HTTP endpoint is a backend route that handles HTTP requests and returns a response, such as JSON data for your site's frontend code. In Studio Two, you add one from the Code tab through Wix Extension Builder, and it runs on Wix servers as part of your site project.

In Studio Two, endpoint files live in src/api/, and their routes have no /api prefix.

When to use HTTP endpoints

Use an HTTP endpoint when your frontend code needs a result that only backend code can produce safely. This includes:

• Calling a 3rd-party API with a key or secret that must not reach the browser.
• Calling Wix APIs with elevated permissions, after you check who the caller is.
• Validating data before you save it, so a site visitor can't bypass your rules.
• Keeping business logic out of code that site visitors can read.

For example, a product page can call an HTTP endpoint that checks live stock levels with a supplier's API. The endpoint reads the supplier's API key from the Secrets Manager, so the key never appears in the page.

Not all backend code belongs in an HTTP endpoint. Use an endpoint when your code needs to run on the backend and none of the other backend extensions fits. For example, to run code when something happens on a site, such as a new contact being created, use a Backend Events extension. To change how a Wix business solution works, use a service plugin.

Anatomy of an HTTP endpoint

An HTTP endpoint in a Studio Two project is a single TypeScript file in the src/api/ folder:

• The file's path sets the route. For example, src/api/stock.ts serves the route stock, and src/api/stock/levels.ts serves the route stock/levels.
• The file exports a handler for each HTTP method it supports, such as GET or POST. Each handler receives a context object with the incoming request, the request url, and the route's dynamic params, and returns a standard Response.

Every .ts or .js file in src/api/, except .d.ts files, becomes a route. Keep shared helper code, such as validation functions, outside src/api/.

Unlike other extension types, an HTTP endpoint has no configuration file. It isn't registered in extensions.ts and doesn't appear under My Extensions. Wix finds it from its location in src/api/. To remove an endpoint, delete its file.

For how file paths map to routes and the full handler contract, see HTTP Endpoint Extension Files and Code.

You generate the file first, then write the handlers and call them from your frontend code. To learn how, see Build an HTTP Endpoint in Studio Two.

How HTTP endpoints are used

• Your frontend code, such as an Editor React Component (ERC), a Data Source, or a dashboard page, calls the endpoint with httpClient.fetchWithAuth() from @wix/essentials. The method sends the caller's access token with the request, which tells the endpoint who's calling.
• Endpoints serve your site's own frontend code. Calls from outside systems aren't supported yet.
• When you publish your site, endpoints ship with it. In the Studio Two editor and Preview, calls from site code work only after you publish your latest code changes.
• Endpoints share the backend compute limits of all Studio Two backend code.

Who can call an HTTP endpoint

HTTP endpoints have no built-in permissions. Every site visitor's browser has an access token, so anyone who loads your site can call any of its endpoints. In every handler, check the caller and validate the input before you return private data or make an elevated call.

Inside a handler, Wix API calls run with the caller's identity. The handler reads that identity with auth.getTokenInfo() from @wix/essentials. To run a specific call with elevated permissions, wrap the method with auth.elevate(). Calls that you don't wrap still run as the caller. For examples, see steps 4 and 5 in Build an HTTP Endpoint in Studio Two.

See also

• HTTP Endpoints
• Add an HTTP Endpoint Extension in Studio Two
• Build an HTTP Endpoint in Studio Two
• HTTP Endpoint Extension Files and Code