REST API Reference

REST API Reference

All endpoints are under the openwp/v1 namespace. MCP endpoints use mcp/v1.

Authentication

All openwp/v1 endpoints require:

• WordPress nonce (X-WP-Nonce header)
• Logged-in user with openwp_run_agent or openwp_manage_settings capability

All mcp/v1 endpoints require:

• Bearer token authentication (Authorization: Bearer <token>)

Response Caching

All openwp/v1 responses include Cache-Control: no-store, no-cache, must-revalidate headers.

---

Agent Endpoints

GET /openwp/v1/bootstrap

Returns configuration and capabilities for frontend initialization.

Permission: openwp_run_agent

Response:

{
    "settings": {...},
    "provider_status": {"has_openai_key": true, ...},
    "actions": [...],
    "capabilities": {...},
    "onboarding": {...},
    "mcp": {...}
}

POST /openwp/v1/agent/execute

Execute agent command (synchronous).

Permission: openwp_run_agent

Body:

{
    "prompt": "Create a blog post about AI",
    "provider": "openai",          // optional
    "model": "gpt-5.2",           // optional
    "conversation_context": {      // optional
        "enabled": true,
        "turns": [{"user": "...", "assistant": "..."}]
    }
}

Response:

{
    "status": "success|failed|no_action|awaiting_approval",
    "mode": "single",
    "provider": "openai",
    "model": "gpt-5.2",
    "agent": {"thought": "...", "action": "...", "params": {}, "confidence": 0.9},
    "execution": {"status": "success", "data": {...}, "log_id": 42},
    "executions": [...],
    "action_plan": [...],
    "token_usage": {"input_tokens": 500, "output_tokens": 200}
}

POST /openwp/v1/agent/execute/stream

Execute agent command with SSE streaming.

Permission: openwp_run_agent

Same body as /agent/execute. Returns text/event-stream with typed events (see Agent Engine for event types).

POST /openwp/v1/editor/generate

Generate content for the Gutenberg editor block.

Permission: edit_posts

Body:

{
    "prompt": "Write a hero section for a SaaS landing page",
    "content_type": "hero_section",
    "tone": "professional",
    "provider": "openai",
    "model": "gpt-5.2"
}

---

Approval Endpoints

GET /openwp/v1/approvals

List pending approvals.

POST /openwp/v1/approvals/{id}/approve

Approve a pending action. For critical actions, requires typed_confirmation: "APPROVE".

POST /openwp/v1/approvals/{id}/reject

Reject a pending action with optional decision_note.

---

Log Endpoints

GET /openwp/v1/logs

List audit log entries with pagination.

POST /openwp/v1/logs/{id}/rollback

Rollback a previously executed action using its stored snapshot.

---

Settings Endpoints

GET /openwp/v1/settings

Get current plugin settings.

POST /openwp/v1/settings

Update plugin settings (merged with existing).

POST /openwp/v1/settings/provider-keys

Save encrypted provider API keys.

GET /openwp/v1/settings/mcp

Get MCP server settings including endpoints and module status.

POST /openwp/v1/settings/mcp

Update MCP settings (enabled, modules, bearer token).

---

Backup Endpoints

GET /openwp/v1/backups

List backup records with pagination.

POST /openwp/v1/backups/{id}/restore

Restore a backup by ID (with checksum verification).

DELETE /openwp/v1/backups/{id}

Delete a backup record and its file.

---

Memory Endpoints

GET /openwp/v1/memory

List agent memory entries.

POST /openwp/v1/memory

Create or update a memory entry.

DELETE /openwp/v1/memory/{id}

Delete a specific memory entry.

DELETE /openwp/v1/memory

Clear all memory entries.

---

Action Endpoints

GET /openwp/v1/actions

List all registered actions with schemas, risk levels, and categories.

POST /openwp/v1/actions/policy

Update per-action policy overrides (enable/disable, approval requirements).

---

Chatbot Endpoints

POST /openwp/v1/chatbot/upload

Upload file attachments for the sitewide chatbot.

---

MCP Endpoints (mcp/v1)

GET /mcp/v1/sse

SSE transport - establishes event stream for MCP communication.

POST /mcp/v1/sse

Direct JSON-RPC over SSE endpoint.

POST /mcp/v1/messages?session_id={id}

Message ingress for SSE transport sessions.

GET|POST|DELETE /mcp/v1/http

Streamable HTTP transport (primary recommended transport).

POST /mcp/v1/upload/{token}

One-time upload endpoint for MCP file transfers.

See MCP Server for JSON-RPC methods and protocol details.