Some good notes from Pavel here;
Few gotchas we found in the Data API that aren't documented:
→ RichText strips <script>, ,</code> silently</p><p>→ Whitespace between <code><ul></code> / <code><li></code> / <code></ul></code> drops list children -- the API GET echoes your HTML back, so the bug only shows up in the rendered page</p><p>→ Soft-deleted slugs reserve permanently (re-imports get suffixed slugs)</p><p>→ MultiReference fields can't retarget collections after creation</p><p>→ macOS Python needs <code>certifi</code> or every HTTPS call fails</p><p></p><p></p><p></p><h2>Notes</h2><p>In my experience, most richtext sanitization occurs during editing. If you open that item in the designer CMS panel, it will get sanitized. </p><p>Outside of that, most operations directly through the Data API are safe. </p><p></p><p></p><p></p>
