hosting

PUT `/v1/sites/{siteId}/wordpress/update-policy`

Set the site's auto-update policy and apply it to WordPress.

Authentication

Send an API key as a bearer token. The key must carry the sites.view permission; a key without it is refused with 403, not 404.

This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.

Try it

Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.

curl -X PUT https://api.zinndigital.com/v1/sites/{siteId}/wordpress/update-policy \
  -H "Authorization: Bearer zdk_live_…" \
  -H "Content-Type: application/json" \
  -d '{ "core": <string<off, minor, all>>, "plugins": <boolean>, "themes": <boolean>, "ring": <string<canary, early, general>> }'

Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console

Details

Stores the policy **and writes it to the site in the same call**, then re-reads the site and returns what it found. ⛔ Storing without applying is the defect this endpoint exists to avoid: a stored row saying `core: off` over a WordPress that is still updating itself is worse than no row, because the screen then says the operator's decision took effect. The response body is a fresh read, never an echo of the request. ⛔ On a failed apply the policy row keeps `apply_error` **and** the call answers `422`. Only recording it would be a silent failure; only raising it would leave a stored policy nobody knows was never applied. `ring` is the **staged-rollout** ring this site belongs to — `canary`, `early` or `general`. It is a property of the site, not of the change, so an operator picks their canaries once and every later rollout inherits the choice. ⛔ **Fleet only** — refused where `wp_update_policy` is `false`, because it is written with `wp config set` and `wp plugin auto-updates` and this platform publishes no equivalent. Requires `sites.view` and `sites.panel_access`.

Parameters

Name	Type	Required	What it is
`siteId (path)`	`Uuid`	Yes	Site ID (UUIDv7).

Request body

Name	Type	Required	What it is
`core`	`string<off, minor, all>`	Yes	`minor` is WordPress's own default (security and maintenance releases); `all` includes major upgrades unattended; `off` disables core auto-updates.
`plugins`	`boolean`	Yes	Whether every plugin should auto-update.
`themes`	`boolean`	Yes	Whether every theme should auto-update.
`ring`	`string<canary, early, general>`	Yes	The staged-rollout ring this site belongs to.

Response

Name	Type	Required	What it is
`core`	`string<off, minor, all>`	Yes	The stored policy for WordPress core updates.
`plugins`	`boolean`	Yes	The stored policy — whether every plugin should auto-update.
`themes`	`boolean`	Yes	The stored policy — whether every theme should auto-update.
`ring`	`string<canary, early, general>`	Yes	The staged-rollout ring this site belongs to.
`applied_at`	`string`	Yes	When the policy last reached the site, ISO-8601, or `""` if it never has. ⛔ A timestamp and not a flag: "when did this last reach the site" is the question an operator asks, and…
`apply_error`	`string`	Yes	Why the last apply failed, or `""`. Kept beside `applied_at` rather than replacing it, so a failed re-apply does not erase that an earlier one worked.
`observed_read`	`boolean`	Yes	Whether the site itself was read. ⛔ An empty `drift` is only meaningful while this is `true`.
`observed_core`	`string`	Yes	What `WP_AUTO_UPDATE_CORE` is set to on the site — `off`, `minor`, `all`, or `""` meaning the constant is not defined at all, so WordPress applies its own default. ⛔ `""` is…
`plugins_off`	`string[]`	Yes	The plugins on this site that are NOT auto-updating.
`themes_off`	`string[]`	Yes	The themes on this site that are NOT auto-updating.
`drift`	`string<core, plugins, themes>[]`	Yes	Which of `core`, `plugins`, `themes` the site disagrees with the policy about.

Errors this endpoint can return

401 · 403 · 404 · 422 · 429 · 503

PUT /v1/sites/{siteId}/wordpress/update-policy