菜单
This skill should be used when the user asks for "PayloadCMS REST endpoint", "Payload curl example", "Payload GraphQL query syntax", "Payload Local API method signature", "Payload login endpoint", "Payload auth headers", or needs the exact HTTP/method signature for a Payload API call.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/Agents-Store/claude-plugins --skill api-reference命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
This skill should be used when the user reports a problem with macstack-dev or the MACSTACK standard — "this skill did the wrong thing", "the schema is missing a field", "the passport for X is wrong", "send macstack feedback", "improve the schema based on my edit", "fix the macstack plugin" — and the fix must land in the right source (plugin, schema repo, or registry repo).
This skill should be used when the user asks to "set up Infisical for this project", "create .infisical.json", "pull the env keys", "wire the env", "sync secrets", or scaffold-project reaches the env step. Creates .infisical.json, pulls .env.prod/.env.dev, ensures every key from macstack.json resources.accesses exists, and installs the mandatory secrets scripts and commands.
This skill should be used when the user asks to "scaffold the project from macstack.json", "create the project working files", "generate project files from the spec", "build the project from macstack.json", or after a macstack.json is validated and the working tree must be built. Creates project files strictly in the prototype → stack plugins → dev plugins order.
基于 SOC 职业分类
| name | api-reference |
| description | This skill should be used when the user asks for "PayloadCMS REST endpoint", "Payload curl example", "Payload GraphQL query syntax", "Payload Local API method signature", "Payload login endpoint", "Payload auth headers", or needs the exact HTTP/method signature for a Payload API call. |
| disable-model-invocation | true |
Endpoint-by-endpoint reference. Triggered only on explicit user request — heavy content lives in references/ files below.
| Surface | Endpoint | When to use |
|---|---|---|
| Local API | In-process JS calls (payload.find, …) | Server-side code, hooks, scripts, server components |
| REST API | /api/<collection>/... | Browser fetch, external services, mobile apps |
| GraphQL | /api/graphql | Typed frontends, codegen pipelines, federation |
All three share the same where query syntax, access control rules, and hook firing order.
Typed external client: @payloadcms/sdk — the official REST SDK (same 3.x version line) for browser/service callers; mirrors Local API options over HTTP.
references/local-api.md — every method on the payload instance with full TypeScript signatures.references/rest-api.md — every REST route grouped by collection-CRUD, globals, auth, uploads, versions, jobs.references/graphql-api.md — auto-generated schema rules, query/mutation patterns, custom resolvers.| Header | Purpose |
|---|---|
Authorization: JWT <token> | Authenticate as a user. Token comes from /api/<auth-collection>/login. |
Authorization: <api-key-collection> API-Key <key> | API key auth (when auth.useAPIKey: true). |
Cookie: payload-token=<jwt> | HTTP-only cookie set by /login. Browser sessions use this. |
The Payload server URL is the Next.js dev/prod URL — typically:
http://localhost:3000https://your-app.comAll routes shown in references are relative to that base.
| Param | Type | Example |
|---|---|---|
where | JSON-encoded object | ?where[status][equals]=published |
sort | string | ?sort=-publishedAt,title |
limit | number | ?limit=50 |
page | number | ?page=2 |
depth | 0–10 | ?depth=2 |
select | object | ?select[title]=true&select[slug]=true |
locale | string | ?locale=es |
fallback-locale | string | ?fallback-locale=en |
draft | boolean | ?draft=true |
Use the qs-esm library (Payload-maintained) to encode complex where clauses from the browser.
REST/GraphQL errors return:
{
"errors": [
{ "message": "You are not allowed to perform this action.", "name": "Forbidden" }
]
}
HTTP status codes: 400 (validation), 401 (auth missing), 403 (access denied), 404 (not found), 500 (server).
Local API throws typed APIError / ValidationError instances — catch and inspect .status / .name.
Inside generated app code, prefer the alias:
import config from '@payload-config'
const payload = await getPayload({ config })
For external clients, read base URL from env (NEXT_PUBLIC_PAYLOAD_URL). Never hardcode localhost or production hosts in committed code.
This skill has disable-model-invocation: true — Claude will not auto-trigger it. Users must reference it explicitly ("show me the REST endpoint for…") or another skill must link to it. See the linked reference files for the full content.