diff --git a/templates/admin/article_create.html b/templates/admin/article_create.html
index 7708a42..e981135 100644
--- a/templates/admin/article_create.html
+++ b/templates/admin/article_create.html
@@ -206,8 +206,8 @@ var easyMDE = new EasyMDE({
         delBtn.className = 'text-red-600 hover:text-red-800 font-medium cursor-pointer bg-transparent border-none';
         delBtn.onclick = function () {
             if (!confirm("{{index .Tr "article_att_delete_confirm"}}")) return;
-            fetch('/admin/articles/attachments/' + att.id + '/delete', {
-                method: 'POST',
+            fetch('/api/admin/articles/attachments/' + att.id, {
+                method: 'DELETE',
                 headers: { 'X-CSRF-Token': csrfToken }
             })
                 .then(function (r) { return r.json(); })
@@ -232,7 +232,7 @@ var easyMDE = new EasyMDE({
         if (articleID) { fd.append('article_id', articleID); }
         else { fd.append('session_token', sessionToken); }
         msgEl.textContent = "{{index .Tr "article_att_uploading"}}";
-        fetch('/admin/articles/attachments', {
+        fetch('/api/admin/articles/attachments', {
             method: 'POST',
             headers: { 'X-CSRF-Token': csrfToken },
             body: fd
@@ -249,7 +249,7 @@ var easyMDE = new EasyMDE({
 
     // Edit page: load existing attachments.
     if (articleID) {
-        fetch('/admin/articles/' + articleID + '/attachments')
+        fetch('/api/admin/articles/' + articleID + '/attachments')
             .then(function (r) { return r.json(); })
             .then(function (r) {
                 (r.attachments || []).forEach(addRow);
diff --git a/templates/pages/profile.html b/templates/pages/profile.html
index e2fb2d4..228a019 100644
--- a/templates/pages/profile.html
+++ b/templates/pages/profile.html
@@ -195,7 +195,7 @@
             var formData = new FormData();
             formData.append('avatar', blob, 'avatar.jpg');
 
-            fetch('/profile/avatar', {
+            fetch('/api/profile/avatar', {
                 method: 'POST',
                 headers: { 'X-CSRF-Token': csrfToken },
                 body: formData,