hosting

POST `/v1/sites/{siteId}/wordpress/cli`

Run one allow-listed WP-CLI command on the site.

Pagpapatotoo

Magpadala ng API key bilang isang bearer token. Kailangang taglayin ng key ang pahintulot na sites.view; ang key na wala nito ay tatanggihan gamit ang 403, hindi 404.

Ang endpoint na ito ay hindi nangangailangan ng id ng organisasyon. Natutukoy na ng iyong key ang organisasyong kinabibilangan nito, at nakatuon ang tugon dito.

Subukan ito

Palitan ang anuman sa loob ng mga panaklong na may anggulo ng iyong sariling mga halaga, at ang placeholder ng key na may key mula sa iyong dashboard.

curl -X POST https://api.zinndigital.com/v1/sites/{siteId}/wordpress/cli \
  -H "Authorization: Bearer zdk_live_…" \
  -H "Content-Type: application/json" \
  -d '{ "command": <string> }'

Nakalagda? Ang API console sa iyong dashboard ay awtomatikong naglalagay ng iyong tunay na ID ng organisasyon at sariling susi, at pinapatakbo ang kahilingan laban sa live na API upang makita mo ang aktwal na tugon. Buksan ang endpoint na ito sa console ng API

Mga Detalye

An audited WP-CLI console. Every invocation is recorded in the site's WordPress activity log with its argv and exit code — never its output. ⛔ **Allow-listed, never arbitrary.** An unrestricted passthrough is remote code execution as the site user: `wp eval` runs arbitrary PHP, `wp db query` runs arbitrary SQL, and `wp --require=/tmp/x.php` loads code the caller chose before WP-CLI decides what to do. The permitted commands are reads and idempotent cache operations, listed by `listWordPressCliCommands`; anything else answers `422` naming the whole list. ⛔ `config get` and `config list` are **deliberately absent** — they read `wp-config.php`, whose constants include the database password and the authentication salts. ⛔ A **non-zero `exit_code` still answers `200`.** The console's product is what WP-CLI said, and mapping a bad argument onto a 4xx would put our error page over the diagnosis the customer asked for. A `422` means *we* refused the command, which is a different answer. ⛔ The command travels in the **body**, not the path, so it never reaches a proxy or edge access log — `option get` names options a plugin may have stored a credential in. ⛔ **Fleet only** — refused where `wp_cli` is `false`. Requires `sites.view` and `sites.panel_access`.

Mga Parameter

Pangalan	Uri	Kailangan	Ano ito
`siteId (path)`	`Uuid`	Oo	Site ID (UUIDv7).

Katawan ng kahilingan

Pangalan	Uri	Kailangan	Ano ito
`command`	`string`	Oo	The WP-CLI command, with or without a leading `wp`.

Tugon

Pangalan	Uri	Kailangan	Ano ito
`argv`	`string[]`	Oo	What actually ran, after the allow-list normalised it — echoed back so `wp plugin list` and `plugin list` are visibly the same command.
`exit_code`	`integer`	Oo	WP-CLI's exit code. `0` is success.
`stdout`	`string`	Oo	What WP-CLI printed, up to the console's cap.
`stderr`	`string`	Oo	WP-CLI's diagnostics, carried separately and never merged into `stdout` — WP-CLI writes PHP notices here on runs that succeed, so folding them together would corrupt the JSO…
`truncated`	`boolean`	Oo	True when `stdout` was cut at the cap. ⛔ Stated rather than hidden: a silently cut-off JSON document is worse than none, because it nearly parses.

Mga error na maibabalik ng endpoint na ito

401 · 403 · 404 · 422 · 429 · 503

POST /v1/sites/{siteId}/wordpress/cli