public
POST /v1/wp/plugin-update/{siteId}
What an installed Zinn® plugin polls for updates.
Authentication
This endpoint takes no API key. Anything else it needs, such as a signed request, is described above.
This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.
Try it
Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.
curl -X POST https://api.zinndigital.com/v1/wp/plugin-update/{siteId} \
-H "Authorization: Bearer zdk_live_…" \
-H "Content-Type: application/json" \
-d '{ "slug": <string>, "version": <string> }'Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console
Details
The WordPress self-hosted update endpoint. It is called by the plugin, not by a person: wp/plugins/*/includes/class-updater.php posts here on WordPress's own update schedule and turns the answer into the ordinary "update available" notice. Authenticated by the site's own secret, never by a bearer token — the caller is a WordPress site, not a principal. The request carries X-Zinn-Cache-Signature: sha256=HMAC(timestamp + "\n" + body) keyed with that site's ZINN_UPDATE_SECRET, and the response is signed the same way in X-Zinn-Signature so a site can prove the answer came from us before installing anything. ⛔ A version staff HALTED (POST /v1/admin/plugin-updates/halts) is never offered here: the answer is the newest offered release that is not halted, or 204 when none is (PF-445). ⛔ A site already on the current version gets 204, not a 200 describing the version it has: the updater re-fetches and re-verifies a package whenever it is offered one. Anything unauthenticated, stale or unknown is a 404 — never a 401, so this cannot become an oracle for which site ids exist.
Parameters
| Name | Type | Required | What it is |
|---|---|---|---|
siteId (path) | Uuid | Yes | Site ID (UUIDv7). |
Request body
| Name | Type | Required | What it is |
|---|---|---|---|
slug | string | Yes | The plugin asking |
version | string | Yes | The version currently installed. |
site | string | No | The site's own home URL |
Response
| Name | Type | Required | What it is |
|---|---|---|---|
version | string | Yes | — |
package | string | Yes | Where to fetch the archive. Always HTTPS on our own hostname — the updater refuses any other host, which is what stops a forged descriptor pointing a site at somebody else's zip. |
package_sha256 | string | Yes | — |
tested | string | No | — |
requires | string | No | — |
requires_php | string | No | — |
changelog | string | No | — |
homepage | string | No | — |
Errors this endpoint can return
404 · 429