Small-footprint headless CMS landscape — 16 lesser-known players we mapped in one evening

~/$ curl https://api.cosmicjs.com/v3/buckets/unknown/objects

$ curl api.cosmicjs.com/v3/buckets/unknown/objects

HTTP/2 401 / tenant error

round-up artifact: one real API probe

Tier-3 CMS shortlist has one verified API artifact

The landscape page needs a visible proof point, not sixteen thin mini-reviews with copied claims.

Fix ready

$ add first-hand matrix row + source links

Cosmic curl documented

16 vendors grouped by real evaluation constraints

SimpleReview AI fix

Click the broken response to attach context

Detected

Round-up risk: scaled-content pattern

Fix plan

Anchor the page on one reproducible Cosmic probe

Result

Landscape map states what was and was not tested

PR: Landscape proof block

+ first-hand artifact table + source URL column + no thin vendor pages

Comment for agentx

Keep the round-up anchored to a real probe|

Fix it*PR drafted

SimpleReview - Tier-3 landscape banner highlights the first-hand artifact rule

Why these sixteen exist

The short version: the big six headless CMSes optimise for "we are an editorial team that needs a CDN, a multi-language model, and a procurement-friendly SOC 2 report." Everyone outside that frame — a Hugo blogger who wants a UI, an Astro developer who wants content in git, a Japanese marketing team that wants a Tokyo-region API, an e-commerce shop that wants PIM and CMS in one box — gets a tool that fits them better than Contentful does. Each of the sixteen below is somebody's "fits me better than the big ones" answer. We've grouped them into four clusters; the clusters aren't perfectly clean (Caisy is both API-first and German, Keystatic is both code-first and git-backed) but a four-cluster map beats a sixteen-row alphabetical list for navigation.

The full comparison — sixteen on one screen

One row per product. Stack column says what you write your front end against and (where applicable) what the CMS itself is built in. Pricing column gives the floor and the next paid step on the day we tested. Source column is the URL we verified the row from on 2026-05-07.

Two rows are honest "we couldn't fully verify" entries: Vault CMS and GitCMS. We left them in because cutting them would make the landscape feel cleaner than it is — the bottom of the long tail has projects with broken homepages, IP-banned servers, and dead Twitter accounts.

Group 1 — open-source git-backed (5)

Group 2 — API-first SaaS small-time (5)

Group 3 — code-first / framework-rooted (3)

Group 4 — niche / orphan (3)

First-hand: curl https://api.cosmicjs.com

Sixteen products is too many for us to hands-on-test each one inside a single article. So we picked one — Cosmic — and ran the same evaluation walk we ran on Contentful in our standalone scout (pricing page + a real curl against the public CDN). One first-hand artifact for the round-up, in keeping with our rule: never ship a CMS write-up without at least one verifiable, dated, reproducible thing the reader can run themselves.

Now the production API. Cosmic's CDN is api.cosmicjs.com at version v3. Hit it with a deliberately invalid bucket slug:

$ curl -sD - "https://api.cosmicjs.com/v3/buckets/INVALID/objects"

HTTP/2 404
content-type: application/json
x-amzn-requestid: e24c554b-0a6b-48df-93b9-67e29b35f395
access-control-allow-origin: *
x-amz-apigw-id: dCK3mEawjoEESxw=
cache-control: private
x-amzn-trace-id: Root=1-69fd8b63-420d8e261e65a2d11e56cf9e;Parent=0734d23220908819
accept-ranges: bytes
via: 1.1 varnish, 1.1 varnish
x-served-by: cache-dub4341-DUB, cache-bma-essb1270041-BMA
x-cache: MISS, MISS
x-timer: S1778223971.429817,VS0,VE175
content-length: 64

{"status":404,"message":"bucket with slug: 'INVALID' not found"}

Three things worth noting in this response, because they tell you most of what you need to know about the platform without reading any docs.

One. The error envelope is flat and human-readable: {"status": 404, "message": "bucket with slug: 'INVALID' not found"}. Compare to Contentful's nested {"sys": {"type": "Error", "id": "NotFound"}, "message": "...", "requestId": "..."}. Cosmic's is friendlier to grep, harder to programmatically switch on. There's no requestId field, so if you escalate to support, you correlate by the AWS x-amzn-requestid header instead.

Two. The infrastructure is AWS API Gateway behind Fastly. x-amz-apigw-id is the API Gateway ID; via: 1.1 varnish + x-served-by: cache-dub4341-DUB, cache-bma-essb1270041-BMA tells you Fastly is fronting it (Dublin and Stockholm-Bromma POPs on this request). Same plumbing shape as Contentful, different POPs.

Three. cache-control: private on a 404 with x-cache: MISS, MISS means the 404 was authoritative from origin, not edge-cached. Good behaviour — the alternative would mean a typo'd bucket slug persisting as an error after the user fixes it.

For comparison, hitting the API root with no auth header:

$ curl -sD - "https://api.cosmicjs.com/v3/"

HTTP/2 403
content-type: application/json
x-amzn-errortype: MissingAuthenticationTokenException
x-amz-apigw-id: dCK3oEYdDoEErZQ=

{"message":"Missing Authentication Token"}

That MissingAuthenticationTokenException is the AWS API Gateway default response for an unrecognised path — not a Cosmic-specific message. /v3/ isn't a defined route; only /v3/buckets/... sub-paths are. The "discover buckets" attack surface is closed at the gateway.

When Tier-3 over Tier-1

The honest answer most developer blogs won't give you: most projects should pick a Tier-1 headless CMS. Storyblok, Contentful, Sanity, Strapi, Directus, Payload, Hygraph — the reason these have 2,000-13,000/mo brand search volume is the same reason they have a thick consideration set: they ship, they have docs, they have a Stack Overflow long tail of answers, the SDKs are maintained, the migration paths in and out are well-trodden. Picking microCMS over Sanity for a generic English-language SaaS in 2026 mostly means you'll have to write your own Stack Overflow answers.

Three situations where one of the sixteen above is genuinely the better answer:

1. Your content lives in git already. If you have a Hugo or Astro site in a GitHub repo, and you want one non-technical person to edit posts, the Tier-1 answer is "spin up a Sanity Studio, write a content adapter, deploy a build pipeline that pulls from Sanity and writes Markdown into your repo on save." The Tier-3 answer is "install Pages CMS or Front Matter, point it at the repo, done." That's a 2-hour Saturday vs a 2-week sprint.
2. You have a regional data-residency requirement that's not EU. microCMS has Tokyo regions because it's a Japanese company. Caisy is a German company on AWS Frankfurt. Flotiq is Polish. If your compliance requirement is "data must stay in country X" and X isn't on the residency list of Contentful or Sanity, the Tier-3 list is where you start.
3. You need a non-CMS feature that's a CMS feature here. Crystallize bundles PIM and content management for commerce. Prepr bundles personalisation and A/B testing as core, not as a $500/mo add-on. ApostropheCMS bundles in-page visual editing the way WordPress does, which most headless CMSes deliberately don't. If a Tier-1 quote includes a $1,000-2,000/mo add-on for the feature you need, a Tier-3 vendor where it's free-tier-included is worth a closer look.

Outside those three: pick a Tier-1. You'll regret it less.

The articles we wrote standalone (Tier 1 + 2)

For the seventeen larger headless CMSes that do clear our brand-volume bar, we have individual scouts — same shape as our Contentful piece. Grouped by tier so you can find the right one:

Tier 1 (~2,000+/mo brand search)

• Storyblok — the visual-editor-first headless CMS, German, generous free tier.
• Ghost — the headless-blog wedge; nonprofit foundation; Node.js; SQLite-or-MySQL.
• Contentstack — behind the "Contact us" wall, enterprise-only pricing.
• Contentful — the legacy incumbent; real curl against cdn.contentful.com; the €300 Lite wall.
• Hygraph — multi-region GraphQL, content federation; ex-GraphCMS.
• Hashnode — developer-blog SaaS with a headless API; the dev-publishing wedge.

Tier 2 (~300–2,000/mo brand search)

• Decap CMS — the renamed Netlify CMS; static-site git CMS; MIT.
• Sitecore XM Cloud — the .NET enterprise; "Contact us" pricing.
• DatoCMS — the GraphQL-first SaaS; Italian; clean DX.
• Optimizely CMS — the personalisation-experimentation enterprise (article TBD).
• ButterCMS — the "API on top of any back end" pitch (article TBD).
• Kontent.ai — ex-Kentico Kontent; SaaS; AI repositioning (article TBD).
• TinaCMS — visual editing on git; React-first.
• Builder.io — visual page-builder; design-to-code AI focus.
• CloudCannon — SSG hosting + visual editing; Jekyll/Hugo/Eleventy first.
• Sanity — Content Lake; structured-content pitch; React Studio.
• Prismic — slice-machine; the component-content wedge (article TBD).
• KeystoneJS — TS-schema-first headless; Thinkmill; same shop as Keystatic above.

And the standalone open-source big-three back-end CMS scouts, which sit adjacent to all of the above: Strapi, Directus, Payload.

What we'd actually do

If we were starting an English-language SaaS marketing site tomorrow with a small editorial team and a Next.js front end, we'd still pick Sanity or Storyblok for the boring stable reason — the SDKs and the Stack Overflow long tail are denser. If we were starting a Hugo blog with one author and one sometimes-editor, we'd pick Pages CMS or Front Matter and not pay anyone. If we were a Japanese marketing team, microCMS. If we needed PIM + commerce + content in one box, Crystallize. The sixteen products here exist because each is the right answer for some specific shape of team the giants don't fit. Knowing the map matters more than knowing each cell.

Things we'd update later: confirm GitCMS liveness from a non-headless browser; pull next-tier pricing for JekyllPad / Sitepins / Spinal beyond the marketing floor; promote ApostropheCMS to a standalone Docker scout if reader interest emerges; track StudioCMS volume into 2026-Q4. SimpleReview — the Chrome extension we ship — works on a Cosmic-rendered front end the same way it works on a microCMS or Keystatic one, because by render time it's just HTML.