API Reference

The Wp Admin REST API allows you to programmatically manage your WordPress infrastructure. All API requests must be made over HTTPS. Calls made over plain HTTP will fail.

Base URL: https://api.wpadmin.com/v1

API Conventions

Endpoints are resource-oriented and follow standard RESTful patterns. The API uses JSON for request/response bodies and standard HTTP status codes to indicate success or failure.

Authentication

Access the API using your personal or team API keys. API keys are tied to your account permissions and can be generated in the Dashboard under Settings → API Keys.

curl "https://api.wpadmin.com/v1/sites" \
  -H "Authorization: Bearer wp_live_sk_8f72a9c1b4e3d0" \
  -H "Content-Type: application/json"

const response = await fetch('https://api.wpadmin.com/v1/sites', {
  method: 'GET',
  headers: {
    'Authorization': `Bearer wp_live_sk_8f72a9c1b4e3d0`,
    'Content-Type': 'application/json'
  }
});

import requests

response = requests.get(
  "https://api.wpadmin.com/v1/sites",
  headers={"Authorization": "Bearer wp_live_sk_8f72a9c1b4e3d0"}
)

Sites

Manage your WordPress sites, view their status, and trigger maintenance tasks.

GET /v1/sites Returns a paginated list of all sites in your account

Query Parameters

Name	Type	Description
limit	integer	Number of results per page (default: 20, max: 100)
cursor	string	Pagination cursor returned from previous request
status	string	Filter by status: `active`, `maintenance`, `suspended`

Response (200 OK)

200

{
  "data": [
    {
      "id": "site_8f72a9c1b4e3",
      "name": "production-store.com",
      "status": "active",
      "wp_version": "6.4.2",
      "php_version": "8.2",
      "last_backup": "2025-03-10T14:32:00Z",
      "health_score": 98
    }
  ],
  "pagination": {
    "next_cursor": "eyJpZCI6MTB9",
    "has_more": true
  }
}

POST /v1/sites Create and provision a new WordPress site

Request Body

Name	Type	Description
domain REQUIRED	string	The primary domain for the WordPress installation
wp_version	string	WordPress version to install (default: latest)
php_version	string	PHP version (7.4, 8.0, 8.1, 8.2, 8.3)
admin_email REQUIRED	string	Administrator email address

Response (201 Created)

201

{
  "id": "site_new_9a2b3c4d",
  "status": "provisioning",
  "estimated_ready": "2025-03-10T15:00:00Z",
  "message": "Site creation initiated. Webhook will notify when complete."
}

Backups

POST /v1/sites/:site_id/backups Trigger an immediate backup for a specific site

Path Parameters

Name	Type	Description
site_id	string	Unique identifier of the target WordPress site

The backup process runs asynchronously. You will receive a backup.completed webhook when finished. Large sites may take 10-30 minutes depending on database size and media uploads.

Rate Limits

API requests are limited based on your subscription tier. Limits are calculated on a rolling 60-second window.

Plan	Requests / Minute	Burst Limit
Starter	60	20
Professional	300	100
Enterprise	1,000	500

Rate limit information is included in every response header:
X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset

Error Handling

The API uses conventional HTTP status codes to indicate success or failure. Codes in the 2xx range indicate success, 4xx indicate client errors, and 5xx indicate server errors.

400

Bad Request - Invalid parameters or malformed JSON

401

Unauthorized - Missing or invalid API key

403

Forbidden - Insufficient permissions

404

Not Found - Resource does not exist

429

Too Many Requests - Rate limit exceeded

500

Internal Server Error - Something went wrong on our end

                        Error Response Format
                    
"error": {
  "code": "invalid_api_key",
  "message": "The provided API key is expired or revoked.",
  "documentation_url": "https://api.wpadmin.com/errors#invalid_api_key"
}

Webhooks

Subscribe to real-time events from your WordPress infrastructure. Webhooks are delivered via POST requests to your registered endpoint.

Event	Description
`site.created`	New site successfully provisioned
`backup.completed`	Backup process finished successfully
`security.threat_detected`	Malware or vulnerability scan found issues
`site.uptime.down`	Site is unreachable for >2 minutes
`update.available`	Core, theme, or plugin update pending

Verify webhook signatures using the X-WpAdmin-Signature header and your webhook secret to ensure payload integrity.