hosting

POST `/v1/sites/{siteId}/wordpress/cli`

Run one allow-listed WP-CLI command on the site.

Uthibitishaji

Tuma ufunguo wa API kama tokeni ya kubeba. Ufunguo lazima uwe na ruhusa ya sites.view; ufunguo usio nayo unakataliwa kwa 403, si 404.

Endpoint hii haichukui kitambulisho cha shirika. Ufunguo wako tayari unalitambua shirika linalohusika, na jibu limewekewa kikomo kwa shirika hilo pekee.

Jaribu

Badilisha chochote kilicho ndani ya mabano ya pembe na maadili yako mwenyewe, na kishikiliaji cha ufunguo na ufunguo kutoka kwa dashibodi yako.

curl -X POST https://api.zinndigital.com/v1/sites/{siteId}/wordpress/cli \
  -H "Authorization: Bearer zdk_live_…" \
  -H "Content-Type: application/json" \
  -d '{ "command": <string> }'

Umeingia kwenye akaunti? Dashibodi yako ya kiweko cha API inajaza kitambulisho chako halisi cha shirika na ufunguo wako mwenyewe, na kuendesha ombi dhidi ya API ya moja kwa moja ili uweze kuona jibu halisi. Fungua sehemu hii ya mwisho (endpoint) kwenye konsole ya API

Maelezo

An audited WP-CLI console. Every invocation is recorded in the site's WordPress activity log with its argv and exit code — never its output. ⛔ **Allow-listed, never arbitrary.** An unrestricted passthrough is remote code execution as the site user: `wp eval` runs arbitrary PHP, `wp db query` runs arbitrary SQL, and `wp --require=/tmp/x.php` loads code the caller chose before WP-CLI decides what to do. The permitted commands are reads and idempotent cache operations, listed by `listWordPressCliCommands`; anything else answers `422` naming the whole list. ⛔ `config get` and `config list` are **deliberately absent** — they read `wp-config.php`, whose constants include the database password and the authentication salts. ⛔ A **non-zero `exit_code` still answers `200`.** The console's product is what WP-CLI said, and mapping a bad argument onto a 4xx would put our error page over the diagnosis the customer asked for. A `422` means *we* refused the command, which is a different answer. ⛔ The command travels in the **body**, not the path, so it never reaches a proxy or edge access log — `option get` names options a plugin may have stored a credential in. ⛔ **Fleet only** — refused where `wp_cli` is `false`. Requires `sites.view` and `sites.panel_access`.

Vigezo

Jina	Aina	Inayohitajika	Kilicho hiki
`siteId (path)`	`Uuid`	Ndiyo	Site ID (UUIDv7).

Mwili wa ombi

Jina	Aina	Inayohitajika	Kilicho hiki
`command`	`string`	Ndiyo	The WP-CLI command, with or without a leading `wp`.

Majibu

Jina	Aina	Inayohitajika	Kilicho hiki
`argv`	`string[]`	Ndiyo	What actually ran, after the allow-list normalised it — echoed back so `wp plugin list` and `plugin list` are visibly the same command.
`exit_code`	`integer`	Ndiyo	WP-CLI's exit code. `0` is success.
`stdout`	`string`	Ndiyo	What WP-CLI printed, up to the console's cap.
`stderr`	`string`	Ndiyo	WP-CLI's diagnostics, carried separately and never merged into `stdout` — WP-CLI writes PHP notices here on runs that succeed, so folding them together would corrupt the JSO…
`truncated`	`boolean`	Ndiyo	True when `stdout` was cut at the cap. ⛔ Stated rather than hidden: a silently cut-off JSON document is worse than none, because it nearly parses.

Hitilafu ambazo mwisho huu unaweza kurudisha

401 · 403 · 404 · 422 · 429 · 503

POST /v1/sites/{siteId}/wordpress/cli