GET /v1/wordpress/plugin-directory

Authentication

Send an API key as a bearer token. The key must carry the sites.view permission; a key without it is refused with 403, not 404.

This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.

Try it

Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.

curl -X GET https://api.zinndigital.com/v1/wordpress/plugin-directory?q=<q> \
  -H "Authorization: Bearer zdk_live_…"

Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console

Details

Plugins a customer can install, from the wordpress.org directory. **Collection-level and not under a site**, because choosing a plugin comes before choosing where to put it — the fleet-wide manager picks the plugin first and the sites second, and hanging this off `/v1/sites/{siteId}/…` would force it to name an irrelevant site to search. An empty or whitespace-only `q` returns an empty page rather than the directory's popularity ranking: sixty thousand plugins nobody asked for, one upstream call per keystroke of nothing. `rating` is normalised to **0–5**. The upstream reports 0–100, and a client rendering that as stars without dividing shows every plugin as full marks. `author` is plain text — upstream sends it as an HTML anchor, which is stripped here so a vendor's markup never reaches our page. Requires `sites.view`. The upstream is unauthenticated and read-only; our egress routing for it is registered as `wordpress_org`.

Parameters

Response

Errors this endpoint can return

401 · 403 · 429 · 503