diff --git a/ui/site/src/api.ts b/ui/site/src/api.ts
new file mode 100644
index 000000000000..ee80e6be93e8
--- /dev/null
+++ b/ui/site/src/api.ts
@@ -0,0 +1,15 @@
+import { Pubsub, PubsubCallback, PubsubEvent } from 'common/pubsub';
+
+const publicEvents = new Set<PubsubEvent>(['content-loaded', 'zen']);
+
+export const api = (ps: Pubsub) => ({
+  pubsub: {
+    on(name: PubsubEvent, cb: PubsubCallback): void {
+      if (!publicEvents.has(name)) throw 'This event is not part of the public API';
+      ps.on(name, cb);
+    },
+    off(name: PubsubEvent, cb: PubsubCallback): void {
+      ps.off(name, cb);
+    },
+  },
+});
diff --git a/ui/site/src/site.ts b/ui/site/src/site.ts
index 46d840b2e7e8..5b7fb1f1be61 100644
--- a/ui/site/src/site.ts
+++ b/ui/site/src/site.ts
@@ -7,6 +7,7 @@ import { unload, redirect, reload } from './reload';
 import announce from './announce';
 import { displayLocale } from 'common/i18n';
 import sound from './sound';
+import { api } from './api';
 import { pubsub } from 'common/pubsub';
 
 const site = window.site;
@@ -14,7 +15,7 @@ const site = window.site;
 // site.manifest is fetched
 // site.info, site.debug are populated by ui/build
 // site.socket, site.quietMode, site.analysis are set elsewhere
-(site as any).pubsub = pubsub; // do not declare in index.d.ts. some extensions need this here
+(site as any).api = api(pubsub); // do not declare in index.d.ts. some extensions need this here
 site.sri = randomToken();
 site.displayLocale = displayLocale;
 site.blindMode = document.body.classList.contains('blind-mode');