hosting
POST /v1/sites/{siteId}/wordpress/cli
Run one allow-listed WP-CLI command on the site.
Authentifizierung
Senden Sie einen API-Schlüssel als Bearer-Token. Der Schlüssel muss über die Berechtigung sites.view verfügen; ein Schlüssel ohne diese wird mit 403 statt 404 abgelehnt.
Dieser Endpunkt erfordert keine Organisations-ID. Ihr Schlüssel identifiziert bereits die zugehörige Organisation, und die Antwort ist entsprechend eingeschränkt.
Ausprobieren
Ersetzen Sie alles in spitzen Klammern durch Ihre eigenen Werte und den Platzhalter für den Schlüssel durch einen Schlüssel aus Ihrem Dashboard.
curl -X POST https://api.zinndigital.com/v1/sites/{siteId}/wordpress/cli \
-H "Authorization: Bearer zdk_live_…" \
-H "Content-Type: application/json" \
-d '{ "command": <string> }'Angemeldet? Die API-Konsole in Ihrem Dashboard trägt automatisch Ihre echte Organisations-ID sowie Ihren eigenen Schlüssel ein und führt die Anfrage gegen die Live-API aus, sodass Sie die tatsächliche Antwort sehen können. Öffnen Sie diesen Endpunkt in der API-Konsole
Details
An audited WP-CLI console. Every invocation is recorded in the site's WordPress activity log with its argv and exit code — never its output. ⛔ **Allow-listed, never arbitrary.** An unrestricted passthrough is remote code execution as the site user: `wp eval` runs arbitrary PHP, `wp db query` runs arbitrary SQL, and `wp --require=/tmp/x.php` loads code the caller chose before WP-CLI decides what to do. The permitted commands are reads and idempotent cache operations, listed by `listWordPressCliCommands`; anything else answers `422` naming the whole list. ⛔ `config get` and `config list` are **deliberately absent** — they read `wp-config.php`, whose constants include the database password and the authentication salts. ⛔ A **non-zero `exit_code` still answers `200`.** The console's product is what WP-CLI said, and mapping a bad argument onto a 4xx would put our error page over the diagnosis the customer asked for. A `422` means *we* refused the command, which is a different answer. ⛔ The command travels in the **body**, not the path, so it never reaches a proxy or edge access log — `option get` names options a plugin may have stored a credential in. ⛔ **Fleet only** — refused where `wp_cli` is `false`. Requires `sites.view` and `sites.panel_access`.
Parameter
| Name | Typ | Erforderlich | Was es ist |
|---|---|---|---|
siteId (path) | Uuid | Ja | Site ID (UUIDv7). |
Anfragekörper
| Name | Typ | Erforderlich | Was es ist |
|---|---|---|---|
command | string | Ja | The WP-CLI command, with or without a leading `wp`. |
Antwort
| Name | Typ | Erforderlich | Was es ist |
|---|---|---|---|
argv | string[] | Ja | What actually ran, after the allow-list normalised it — echoed back so `wp plugin list` and `plugin list` are visibly the same command. |
exit_code | integer | Ja | WP-CLI's exit code. `0` is success. |
stdout | string | Ja | What WP-CLI printed, up to the console's cap. |
stderr | string | Ja | WP-CLI's diagnostics, carried **separately** and never merged into `stdout` — WP-CLI writes PHP notices here on runs that succeed, so folding them together would corrupt the JSO… |
truncated | boolean | Ja | True when `stdout` was cut at the cap. ⛔ Stated rather than hidden: a silently cut-off JSON document is worse than none, because it nearly parses. |
Fehler, die dieser Endpunkt zurückgeben kann
401 · 403 · 404 · 422 · 429 · 503