CaptainCore
GitHub
Docs API

Endpoint index

Every route registered under captaincore/v1, with its methods and permission requirement, grouped by area.

This is the complete list of routes CaptainCore Manager registers, generated from the register_rest_route calls in captaincore_register_rest_endpoints(). Every path below is relative to:

https://your-manager.example.com/wp-json/captaincore/v1

Paths are shown exactly as registered, including their regular expression capture groups, so (?P<id>[\d]+) means a numeric id in that position.

Reading the permission column

Value Meaning
Public __return_true. The route is unauthenticated at the REST layer and does its own checking, usually with a token or a signature
Logged in Any authenticated user. The handler scopes results to accounts you belong to
Administrator captaincore_admin_permission_check, or an inline current_user_can( 'manage_options' )
Administrator or CLI token Accepts either an administrator application password or the shared CLI token
Owner or administrator You created the record, or you are an administrator
Logged in, domain access Logged in, and the handler verifies you can reach the domain before running

Most routes also set show_in_index => false, so they do not appear in the WordPress REST discovery document at /wp-json/. That is a discoverability choice, not a security one.

Route count

304 route registrations covering 268 distinct paths. Some paths are registered more than once, one registration per HTTP method.

Ingest and CLI

Method Path Permission
POST /api Public
POST /cli/connect Administrator or CLI token
GET /configs Administrator
POST /listen-processes Administrator
GET /site-lookup Administrator

Authentication and current user

Method Path Permission
POST /login Public
GET /me/ Logged in
GET /me/api-docs Logged in
POST /me/application-password Logged in
DELETE /me/application-password Logged in
POST /me/application-password/rotate Logged in
GET /me/application-passwords Logged in
POST /me/application-passwords Logged in
DELETE /me/application-passwords/(?P<uuid>[a-fA-F0-9-]+) Logged in
POST /me/email-subscriber Logged in
POST /me/legacy-ui Logged in
POST /me/pins Logged in
PUT /me/profile Logged in
POST /me/tfa_activate Logged in
POST /me/tfa_deactivate Logged in
POST /me/tfa_validate Logged in
GET, DELETE /sessions Logged in
GET /verify-login Public

Sites

Method Path Permission
GET /environment/(?P<id>[\d]+)/files Logged in
DELETE /environment/(?P<id>[\d]+)/files Logged in
GET /environments Logged in
GET `/filters/(?P[a-zA-Z0-9-,+_%)]+)/sites/versions=(?:(?P[a-zA-Z0-9-,+. ]+))?/statuses=(?:(?P[a-zA-Z0-9-,+.
GET `/filters/(?P[a-zA-Z0-9-, _%]+)/statuses/`
GET `/filters/(?P[a-zA-Z0-9-, _%]+)/versions/`
POST /filters/sites Logged in
GET /requested-sites Logged in
POST /site-accounts Administrator
GET /site-filters Logged in
POST /site-requests Logged in
GET /site-requests Logged in
POST /site-requests/back Logged in
POST /site-requests/continue Logged in
POST /site-requests/delete Logged in
PUT /site-requests/update Logged in
GET /site/(?P<id>[\d]+)/(?P<environment>[a-zA-Z0-9-]+)/backups Logged in
GET /site/(?P<id>[\d]+)/(?P<environment>[a-zA-Z0-9-]+)/captures Logged in
GET /site/(?P<id>[\d]+)/(?P<environment>[a-zA-Z0-9-]+)/logs-archive Logged in
GET /site/(?P<id>[\d]+)/(?P<environment>[a-zA-Z0-9-]+)/logs-archive/download Logged in
GET /site/(?P<id>[\d]+)/(?P<environment>[a-zA-Z0-9-]+)/logs-archive/view Logged in
POST /site/(?P<id>[\d]+)/analytics Logged in
GET /site/(?P<id>[\d]+)/snapshots Logged in
GET /site/(?P<id>[\d]+)/snapshots/(?P<snapshot_id>[\d]+)-(?P<token>[a-zA-Z0-9-]+)/(?P<snapshot_name>[a-zA-Z0-9-]+) Public
POST /sites Administrator
GET /sites/ Logged in
POST /sites/(?P<id>[\d]+) Logged in
DELETE /sites/(?P<id>[\d]+) Logged in
GET /sites/(?P<id>[\d]+)/(?P<environment>[^/]+)/session-snapshots Administrator
GET /sites/(?P<id>[\d]+)/(?P<environment>[a-zA-Z0-9-]+)/backups/(?P<backup_id>[a-zA-Z0-9-]+) Logged in
POST /sites/(?P<id>[\d]+)/(?P<environment>[a-zA-Z0-9-]+)/captures Logged in
GET /sites/(?P<id>[\d]+)/(?P<environment>[a-zA-Z0-9-]+)/captures/new Logged in
GET /sites/(?P<id>[\d]+)/(?P<environment>[a-zA-Z0-9-]+)/domains Logged in
POST /sites/(?P<id>[\d]+)/(?P<environment>[a-zA-Z0-9-]+)/domains Logged in
DELETE /sites/(?P<id>[\d]+)/(?P<environment>[a-zA-Z0-9-]+)/domains Logged in
PUT /sites/(?P<id>[\d]+)/(?P<environment>[a-zA-Z0-9-]+)/domains/primary Logged in
POST /sites/(?P<id>[\d]+)/(?P<environment>[a-zA-Z0-9-]+)/domains/verify Logged in
GET /sites/(?P<id>[\d]+)/(?P<environment>[a-zA-Z0-9-]+)/logs Logged in
POST /sites/(?P<id>[\d]+)/(?P<environment>[a-zA-Z0-9-]+)/logs/fetch Logged in
GET /sites/(?P<id>[\d]+)/(?P<environment>[a-zA-Z0-9-]+)/magiclogin Logged in
GET /sites/(?P<id>[\d]+)/(?P<environment>[a-zA-Z0-9-]+)/magiclogin/(?P<user_id>[\d]+) Logged in
POST /sites/(?P<id>[\d]+)/(?P<environment>[a-zA-Z0-9-]+)/monitor Logged in
POST, GET /sites/(?P<id>[\d]+)/(?P<environment>[a-zA-Z0-9-]+)/performance-monitor Logged in
GET /sites/(?P<id>[\d]+)/(?P<environment>[a-zA-Z0-9-]+)/phpmyadmin Logged in
GET /sites/(?P<id>[\d]+)/(?P<environment>[a-zA-Z0-9-]+)/sync/data Logged in
PUT /sites/(?P<id>[\d]+)/accounts Administrator
POST /sites/(?P<id>[\d]+)/backup Logged in
GET /sites/(?P<id>[\d]+)/details Logged in
GET /sites/(?P<id>[\d]+)/environments Logged in
POST /sites/(?P<id>[\d]+)/environments Administrator
PUT, DELETE /sites/(?P<id>[\d]+)/environments/(?P<environment_id>[\d]+) Administrator
GET /sites/(?P<id>[\d]+)/environments/(?P<environment_id>[\d]+)/audit-coverage Logged in
GET /sites/(?P<id>[\d]+)/environments/(?P<environment_id>[\d]+)/audit-coverage/(?P<hash>[a-fA-F0-9]{40,64}) Logged in
POST /sites/(?P<id>[\d]+)/environments/connect Administrator
PUT /sites/(?P<id>[\d]+)/fathom Administrator
POST /sites/(?P<id>[\d]+)/grant-access Logged in
PUT /sites/(?P<id>[\d]+)/identity Administrator
POST /sites/(?P<id>[\d]+)/invite Logged in
GET /sites/(?P<id>[\d]+)/invite-preview Logged in
PUT /sites/(?P<id>[\d]+)/mailgun Administrator
GET /sites/(?P<id>[\d]+)/mailgun-events Logged in
POST /sites/(?P<id>[\d]+)/remote-sync Administrator
PUT /sites/(?P<id>[\d]+)/settings Logged in
GET /sites/(?P<id>[\d]+)/site-audits Logged in
GET /sites/(?P<id>[\d]+)/snapshot-link/(?P<snapshot_id>[\d]+) Logged in
GET /sites/(?P<id>[\d]+)/stats Logged in
POST /sites/(?P<id>[\d]+)/stats/share Logged in
GET /sites/(?P<id>[\d]+)/stats/top-pages Logged in
GET /sites/(?P<id>[\d]+)/stats/top-referrers Logged in
GET /sites/(?P<id>[\d]+)/timeline Logged in
GET /sites/(?P<id>[\d]+)/update-logs Logged in
GET /sites/(?P<id>[\d]+)/usage-breakdown Logged in
GET /sites/(?P<id>[\d]+)/users Logged in
GET /sites/(?P<site>[a-zA-Z0-9-]+) Logged in
GET /sites/(?P<site_id>[\d]+)/environments/(?P<environment_id>[\d]+)/push-targets Logged in
POST /sites/bulk-tools Logged in
POST /sites/cli Logged in
POST /sites/environments/push Logged in
POST /sites/fetch Logged in
PUT /sites/update Administrator

Quicksaves, update logs and archives

Method Path Permission
GET /archive Logged in
POST /archive/share Logged in
POST /archive/store Logged in
GET /quicksaves Logged in
GET /quicksaves/(?P<hash>[a-zA-Z0-9-]+) Logged in
GET /quicksaves/(?P<hash>[a-zA-Z0-9-]+)/artifact Public
GET /quicksaves/(?P<hash>[a-zA-Z0-9-]+)/blueprint Public
GET /quicksaves/(?P<hash>[a-zA-Z0-9-]+)/changed Logged in
GET /quicksaves/(?P<hash>[a-zA-Z0-9-]+)/filediff Logged in
POST /quicksaves/(?P<hash>[a-zA-Z0-9-]+)/rollback Logged in
POST /quicksaves/(?P<hash>[a-zA-Z0-9-]+)/sandbox-token Logged in
GET /quicksaves/search Logged in
GET /update-logs Logged in
GET /update-logs/(?P<hash_before>[a-zA-Z0-9-]+)_(?P<hash_after>[a-zA-Z0-9-]+) Logged in

Running code and jobs

Method Path Permission
GET /jobs/(?P<id>[a-zA-Z0-9-]+) Administrator
GET /my-jobs/(?P<token>[a-zA-Z0-9]+) Logged in
DELETE /my-jobs/(?P<token>[a-zA-Z0-9]+) Logged in
GET /my-jobs/(?P<token>[a-zA-Z0-9]+)/stream Logged in
GET /process-logs Administrator
POST /process-logs Logged in
POST /process-logs/(?P<id>[\d]+) Owner or administrator
GET /process-logs/(?P<id>[\d]+) Logged in
DELETE /process-logs/(?P<id>[\d]+) Owner or administrator
POST /processes Administrator
GET /processes/ Administrator
GET /processes/(?P<id>[\d]+) Administrator
PUT /processes/(?P<id>[\d]+) Administrator
GET /processes/(?P<id>[\d]+)/raw Administrator
GET /progress/ Administrator
DELETE /progress/(?P<pid>[\d]+) Administrator
GET /progress/(?P<pid>[\d]+) Administrator
POST /recipes Logged in
GET /recipes/ Logged in
PUT /recipes/(?P<id>[\d]+) Logged in
DELETE /recipes/(?P<id>[a-zA-Z0-9-]+) Logged in
POST /run/code Logged in
GET /running/ Logged in
DELETE /scripts/(?P<id>[\d]+) Logged in
POST /scripts/(?P<id>[\d]+) Logged in
POST /scripts/schedule Logged in

Domains, DNS and email

Method Path Permission
GET /dns/(?P<id>[\d]+) Logged in
POST /dns/(?P<id>[\d]+)/bulk Logged in
POST /dns/(?P<id>[\d]+)/records Logged in, domain access
PUT /dns/(?P<id>[\d]+)/records/(?P<record_id>[\d]+) Logged in, domain access
DELETE /dns/(?P<id>[\d]+)/records/(?P<record_id>[\d]+) Logged in, domain access
GET /domain/(?P<id>[\d]+) Logged in
POST /domain/(?P<id>[\d]+)/activate-dns-zone Logged in
POST /domain/(?P<id>[\d]+)/activate-forward-email Logged in
GET /domain/(?P<id>[\d]+)/auth_code Logged in
POST /domain/(?P<id>[\d]+)/contacts Logged in
DELETE /domain/(?P<id>[\d]+)/dns-zone Logged in
DELETE /domain/(?P<id>[\d]+)/email-forwarding Administrator
GET /domain/(?P<id>[\d]+)/email-forwarding/logs Logged in
GET /domain/(?P<id>[\d]+)/email-forwarding/status Logged in
GET /domain/(?P<id>[\d]+)/email-forwards Logged in
POST /domain/(?P<id>[\d]+)/email-forwards Logged in
PUT /domain/(?P<id>[\d]+)/email-forwards/(?P<alias_id>[a-zA-Z0-9-]+) Logged in
DELETE /domain/(?P<id>[\d]+)/email-forwards/(?P<alias_id>[a-zA-Z0-9-]+) Logged in
GET `/domain/(?P[\d]+)/lock_(?P[a-zA-Z0-9-, _%]+)`
GET /domain/(?P<id>[\d]+)/mailgun Logged in
DELETE /domain/(?P<id>[\d]+)/mailgun Logged in
POST /domain/(?P<id>[\d]+)/mailgun/deploy Logged in
GET /domain/(?P<id>[\d]+)/mailgun/events Logged in
POST /domain/(?P<id>[\d]+)/mailgun/setup Logged in
GET /domain/(?P<id>[\d]+)/mailgun/suppressions/(?P<type>[a-z]+) Logged in
DELETE /domain/(?P<id>[\d]+)/mailgun/suppressions/(?P<type>[a-z]+) Logged in
GET /domain/(?P<id>[\d]+)/mailgun/usage Logged in
POST /domain/(?P<id>[\d]+)/mailgun/verify Logged in
POST /domain/(?P<id>[\d]+)/nameservers Logged in
GET `/domain/(?P[\d]+)/privacy_(?P[a-zA-Z0-9-, _%]+)`
POST /domain/(?P<id>[\d]+)/update-site-link Logged in
POST /domains Logged in
GET /domains/ Logged in
DELETE /domains/(?P<id>[\d]+) Logged in
PUT /domains/(?P<id>[\d]+)/account Administrator
GET /domains/(?P<id>[\d]+)/zone Logged in
POST /domains/import Logged in

Accounts, users, billing

Method Path Permission
GET /accounts/ Logged in
POST /accounts/ Administrator
GET /accounts/(?P<id>[\d]+) Logged in
PUT /accounts/(?P<id>[\d]+) Logged in
DELETE /accounts/(?P<id>[\d]+) Administrator
PUT /accounts/(?P<id>[\d]+)/defaults Logged in
POST /accounts/(?P<id>[\d]+)/invites Logged in
DELETE /accounts/(?P<id>[\d]+)/invites/(?P<invite_id>[\d]+) Logged in
PUT /accounts/(?P<id>[\d]+)/plan Administrator
DELETE /accounts/(?P<id>[\d]+)/users/(?P<user_id>[\d]+) Logged in
PUT /accounts/(?P<id>[\d]+)/users/(?P<user_id>[\d]+)/level Logged in
GET /billing/ Logged in
POST /billing/ach/admin-verify Administrator
POST /billing/ach/payment-method Logged in
GET /billing/ach/pending Administrator
POST /billing/ach/setup-intent Logged in
POST /billing/ach/verify Logged in
POST /billing/cancel-plan Logged in
POST /billing/pay-invoice Logged in
POST /billing/payment-methods Logged in
DELETE /billing/payment-methods/(?P<id>[a-zA-Z0-9_]+) Logged in
PUT /billing/payment-methods/(?P<id>[a-zA-Z0-9_]+)/primary Logged in
POST /billing/request-plan-changes Logged in
PUT /billing/update Logged in
GET /email/subscription Public
GET /invites Logged in
POST /invites/accept Logged in
GET /invoices/(?P<id>[\d]+) Logged in
GET /invoices/(?P<id>[\d]+)/pdf Logged in
GET /subscriptions/ Logged in
GET /subscriptions/(?P<id>[\d]+) Logged in
GET /upcoming_subscriptions/ Logged in
POST /users Administrator
GET /users/ Logged in
GET /users/(?P<id>[\d]+) Administrator
PUT /users/(?P<id>[\d]+) Administrator
GET /users/(?P<id>[\d]+)/accounts Logged in

Providers and keys

Method Path Permission
GET /configurations/ Logged in
POST /configurations/ Administrator
PUT /configurations/global Administrator
GET /defaults/ Administrator
PUT /defaults/global Administrator
POST /keys Administrator
GET /keys/ Administrator
PUT /keys/(?P<id>[\d]+) Administrator
DELETE /keys/(?P<id>[\d]+) Administrator
PUT /keys/(?P<id>[\d]+)/primary Administrator
GET /provider-actions Logged in
GET /provider-actions/(?P<id>[\d]+)/run Logged in
GET /provider-actions/check Logged in
GET /providers Logged in
POST /providers Logged in
PUT /providers/(?P<id>[\d]+) Logged in
DELETE /providers/(?P<id>[\d]+) Logged in
POST /providers/(?P<id>[\d]+)/connect Logged in
POST /providers/(?P<id>[\d]+)/import Logged in
GET /providers/(?P<id>[\d]+)/remote-sites Logged in
GET /providers/(?P<id>[\d]+)/verify Logged in
POST /providers/(?P<provider>[a-zA-Z0-9-]+)/deploy-to-production Logged in
POST /providers/(?P<provider>[a-zA-Z0-9-]+)/deploy-to-staging Logged in
POST /providers/(?P<provider>[a-zA-Z0-9-]+)/new-site Logged in
GET /providers/(?P<provider>[a-zA-Z0-9-]+)/plugin/(?P<id>[a-zA-Z0-9-]+)/download Logged in
GET /providers/(?P<provider>[a-zA-Z0-9-]+)/plugins Logged in
GET /providers/(?P<provider>[a-zA-Z0-9-]+)/theme/(?P<id>[a-zA-Z0-9-]+)/download Logged in
GET /providers/(?P<provider>[a-zA-Z0-9-]+)/themes Logged in
POST /providers/kinsta/check-verification Logged in
GET /wp-plugins Logged in
GET /wp-themes Logged in

Security operations

Method Path Permission
GET /checksum-failures Administrator
GET /component-hashes Administrator
GET /component-queue Administrator
GET /component-sites Administrator
PUT /core-update-results/(?P<result_id>[\d]+) Administrator
GET /core-update-runs Administrator
GET /core-update-runs/(?P<id>[\d]+) Administrator
GET /core-update-runs/(?P<id>[\d]+)/groups Administrator
GET /core-update-runs/(?P<id>[\d]+)/results Administrator
GET /fleet-severity-counts Administrator
GET /fleet-site-counts Administrator
POST /malware-alert Administrator
GET /plugin-checksum-failures Administrator
POST /plugin-diff-preview Administrator
GET /security-coverage Administrator
POST /security-patches Administrator
GET /security-patches Administrator
DELETE /security-patches/(?P<id>[\d]+) Administrator
POST /security-patches/check Public
GET /security-patches/manifest Administrator
GET /security-threats Administrator
GET /security-threats/affected-sites Administrator
POST /security-threats/note Administrator
POST /security-threats/resolve Administrator
POST /security-threats/track Administrator
GET /session-anomalies Administrator
GET /site-audits Logged in
POST /site-audits Administrator
GET /site-audits/(?P<id>[\d]+) Logged in
PUT /site-audits/(?P<id>[\d]+) Administrator
DELETE /site-audits/(?P<id>[\d]+) Administrator
POST /site-audits/(?P<id>[\d]+)/cancel Logged in
POST /site-audits/(?P<id>[\d]+)/findings Administrator
PUT /site-audits/(?P<id>[\d]+)/findings/(?P<finding_id>[\d]+) Administrator
DELETE /site-audits/(?P<id>[\d]+)/findings/(?P<finding_id>[\d]+) Administrator
GET /site-audits/(?P<id>[\d]+)/html Logged in
POST /site-audits/(?P<id>[\d]+)/publish Logged in
DELETE /site-audits/(?P<id>[\d]+)/publish Logged in
POST /site-audits/request Logged in
GET /update-queue Administrator
POST /update-queue/run Administrator
GET /web-risk-logs Administrator

Reports, newsletter and integrations

Method Path Permission
POST /account-report/default-recipient Administrator
POST /account-report/preview Administrator
POST /account-report/send Administrator
GET /activity-logs Logged in
POST /missive Public
GET /newsletter/(?P<id>[\d]+) Administrator
POST /newsletter/(?P<id>[\d]+)/action Administrator
POST /report/default-recipient Logged in
POST /report/preview Logged in
POST /report/send Logged in
GET /scheduled-reports Logged in
POST /scheduled-reports Logged in
PUT /scheduled-reports/(?P<id>\d+) Logged in
DELETE /scheduled-reports/(?P<id>\d+) Logged in

Notes on specific routes

POST /api is the CLI ingest endpoint. It is public at the REST layer and authenticated by a constant-time token comparison inside the handler. See CLI ingest contract.

POST /missive is public but verifies an HMAC signature in the X-Hook-Signature header against the CAPTAINCORE_MISSIVE_API constant.

POST /security-patches/check is public on purpose. It is what a site’s own update check calls to ask whether a patched build exists for a component it has installed.

GET /quicksaves/{hash}/blueprint, GET /quicksaves/{hash}/artifact and GET /site/{id}/snapshots/{snapshot_id}-{token}/{name} are public because the token in the path is the credential. They exist so a WordPress Playground blueprint or a snapshot download link can be opened without a session.

POST /login and GET /verify-login are the login flow, and GET /email/subscription serves the unsubscribe page from an emailed link, so all three are necessarily public.

GET /filters/{name}/sites/versions={versions}/statuses={statuses} encodes its filters into the path rather than the query string. Both segments are optional inside the pattern.

GET, DELETE /sessions uses is_user_logged_in directly rather than the CaptainCore wrapper. These are WordPress session_tokens, the browser logins shown under Profile, Active sessions. Application password calls do not create a WordPress session and so do not appear here.

The full source is captaincore.php, and the user-facing reference with request and response bodies is api-docs.md.