hosting
POST /v1/sites/{siteId}/wordpress/cli
Run one allow-listed WP-CLI command on the site.
Authentication
Send an API key as a bearer token. The key must carry the sites.view permission; a key without it is refused with 403, not 404.
This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.
Try it
Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.
curl -X POST https://api.zinndigital.com/v1/sites/{siteId}/wordpress/cli \
-H "Authorization: Bearer zdk_live_…" \
-H "Content-Type: application/json" \
-d '{ "command": <string> }'Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console
Details
An audited WP-CLI console. Every invocation is recorded in the site's WordPress activity log with its argv and exit code — never its output. ⛔ Allow-listed, never arbitrary. An unrestricted passthrough is remote code execution as the site user: wp eval runs arbitrary PHP, wp db query runs arbitrary SQL, and wp --require=/tmp/x.php loads code the caller chose before WP-CLI decides what to do. The permitted commands are reads and idempotent cache operations, listed by listWordPressCliCommands; anything else answers 422 naming the whole list. ⛔ config get and config list are deliberately absent — they read wp-config.php, whose constants include the database password and the authentication salts. ⛔ A non-zero exit_code still answers 200. The console's product is what WP-CLI said, and mapping a bad argument onto a 4xx would put our error page over the diagnosis the customer asked for. A 422 means we refused the command, which is a different answer. ⛔ The command travels in the body, not the path, so it never reaches a proxy or edge access log — option get names options a plugin may have stored a credential in. ⛔ Fleet only — refused where wp_cli is false. Requires sites.view and sites.panel_access.
Parameters
| Name | Type | Required | What it is |
|---|---|---|---|
siteId (path) | Uuid | Yes | Site ID (UUIDv7). |
Request body
| Name | Type | Required | What it is |
|---|---|---|---|
command | string | Yes | The WP-CLI command, with or without a leading wp. |
Response
| Name | Type | Required | What it is |
|---|---|---|---|
argv | string[] | Yes | What actually ran, after the allow-list normalised it — echoed back so wp plugin list and plugin list are visibly the same command. |
exit_code | integer | Yes | WP-CLI's exit code. 0 is success. |
stdout | string | Yes | What WP-CLI printed, up to the console's cap. |
stderr | string | Yes | WP-CLI's diagnostics, carried separately and never merged into stdout — WP-CLI writes PHP notices here on runs that succeed, so folding them together would corrupt the JSON… |
truncated | boolean | Yes | True when stdout was cut at the cap. ⛔ Stated rather than hidden: a silently cut-off JSON document is worse than none, because it nearly parses. |
Errors this endpoint can return
401 · 403 · 404 · 422 · 429 · 503