hosting

POST `/v1/sites/{siteId}/wordpress/uploads`

Start a resumable upload of a plugin or theme zip.

Authentication

Send an API key as a bearer token. The key must carry the sites.view permission; a key without it is refused with 403, not 404.

This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.

Try it

Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.

curl -X POST https://api.zinndigital.com/v1/sites/{siteId}/wordpress/uploads \
  -H "Authorization: Bearer zdk_live_…" \
  -H "Content-Type: application/json" \
  -d '{ "kind": <string<plugin, theme>>, "size": <integer> }'

Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console

Details

Opens a resumable upload of a plugin or theme zip of up to 256 MB. Use it for anything larger than a few megabytes, and always on a slow or unreliable connection. The file travels as small parts, each its own request, so no request comes near a timeout and a dropped connection costs one part rather than the whole file (D28103). The protocol: start (this call, declaring the file's size) → PUT every part (uploadSiteWordPressUploadPart, the platform decides part_size) → complete with the whole-file checksum. GET the upload at any point to see which parts have arrived, which is how a client resumes after a drop. Unfinished uploads expire after 24 hours and their parts are deleted. Refused up front, before any byte is sent: 413 for a file over 256 MB, 422 when the plan does not include uploading this kind. Requires sites.view and sites.panel_access.

Parameters

Name	Type	Required	What it is
`siteId (path)`	`Uuid`	Yes	Site ID (UUIDv7).

Request body

Name	Type	Required	What it is
`kind`	`string<plugin, theme>`	Yes	—
`size`	`integer`	Yes	The file's exact size in bytes.
`file_name`	`string`	No	Shown back to the customer only. Never used as a path anywhere.
`activate`	`boolean`	No	Activate after installing. Omitted: a plugin is activated and a theme is not, the same defaults as the single-request install.

Response

Name	Type	Required	What it is
`id`	`string`	Yes	—
`kind`	`string<plugin, theme>`	Yes	—
`status`	`string<open, assembling, installed, failed>`	Yes	—
`size`	`integer`	Yes	—
`part_size`	`integer`	Yes	Bytes per part, chosen by the platform. Every part but the last is exactly this long.
`part_count`	`integer`	Yes	—
`file_name`	`string`	Yes	—
`activate`	`boolean`	Yes	—
`message`	`string`	Yes	On `failed`, what went wrong, written for the customer. Empty otherwise.
`expires_at`	`string`	Yes	—
`created_at`	`string`	Yes	—
`finished_at`	`string`	Yes	—
`received_parts`	`integer[]`	No	Present while `open` — the part numbers already stored.

Errors this endpoint can return

401 · 403 · 404 · 413 · 422 · 429 · 503

POST /v1/sites/{siteId}/wordpress/uploads