Blog authors API

Author profiles are who a reader (and a search engine judging expertise and trust) sees behind a post: a name, a role, a short bio and links that prove the person is real. They live on the dashboard surface (/api/*) of the backend, not the SDK's /v1 surface.

How a post finds its author

A post stores only an author name (author_name). The profile whose name matches it, ignoring case, is attached to that post when it is read on its own:

• GET /api/public/blog/:slug and GET /api/admin/blog/:id return post.author_profile, the matching profile or null.
• Lists (GET /api/public/blog, GET /api/admin/blog) do not carry it.

Posts are never changed by a profile. Deleting or renaming a profile leaves every post as it was; posts using the old name simply stop matching and author_profile becomes null (the site then falls back to its company byline). Rename an author only after updating the posts that use the name.

Rules

• name is required, at most 120 characters, and unique ignoring case (409 otherwise).
• role at most 120 characters. bio at most 600.
• image_url is empty, an https:// address, or an image from the media library (/media/<id>.<ext>).
• same_as is at most 6 https:// addresses (LinkedIn, X, GitHub, a personal site), de-duplicated. javascript:, data: and plain http: are refused.

All endpoints below require an admin session.

GET /api/admin/blog/authors

{
  "authors": [
    {
      "id": "…",
      "name": "Mohammad Ayan",
      "role": "Founder, PixelFox",
      "bio": "Builds server-side tracking for e-commerce stores.",
      "image_url": "",
      "same_as": ["https://www.linkedin.com/in/example"],
      "created_at": "2026-11-10T09:00:00.000Z",
      "updated_at": "2026-11-10T09:00:00.000Z"
    }
  ]
}

Ordered by name.

POST /api/admin/blog/authors

Body: { "name": "…", "role": "…", "bio": "…", "image_url": "…", "same_as": ["https://…"] } (only name is required). Answers 201 { "author": { … } }, 400 for an invalid field, 409 when the name is taken.

PATCH /api/admin/blog/authors/:id

Any of the same fields; only those sent change. Answers { "author": { … } }, 404 for an unknown id, 409 when the new name is taken.

DELETE /api/admin/blog/authors/:id

Answers { "ok": true }, or 404. Posts are untouched.

MCP tools

The blog MCP server (/mcp) exposes the same operations: blog_list_authors, blog_save_author (creates, or updates when given an author id) and blog_delete_author.