hosting

POST `/v1/sites/{siteId}/wordpress/cli`

Run one allow-listed WP-CLI command on the site.

Kimlik Doğrulama

Bearer token olarak bir API anahtarı gönderin. Anahtar sites.view iznine sahip olmalıdır; bu izne sahip olmayan bir anahtar 404 ile değil, 403 ile reddedilir.

Bu uç nokta hiçbir organizasyon kimliği almaz. Anahtarınız zaten ait olduğu organizasyonu tanımlar ve yanıt bu organizasyonla sınırlandırılır.

Dene

Köşeli parantez içindeki her şeyi kendi değerlerinizle ve anahtar yer tutucusunu panonuzdan bir anahtarla değiştirin.

curl -X POST https://api.zinndigital.com/v1/sites/{siteId}/wordpress/cli \
  -H "Authorization: Bearer zdk_live_…" \
  -H "Content-Type: application/json" \
  -d '{ "command": <string> }'

Oturum açtınız mı? Panonuzdaki API konsolu, gerçek organizasyon kimliğinizi ve kendi anahtarınızı otomatik olarak doldurur ve isteği canlı API üzerinde çalıştırarak gerçek yanıtı görmenizi sağlar. Bu uç noktayı API konsolunda açın

Ayrıntılar

An audited WP-CLI console. Every invocation is recorded in the site's WordPress activity log with its argv and exit code — never its output. ⛔ **Allow-listed, never arbitrary.** An unrestricted passthrough is remote code execution as the site user: `wp eval` runs arbitrary PHP, `wp db query` runs arbitrary SQL, and `wp --require=/tmp/x.php` loads code the caller chose before WP-CLI decides what to do. The permitted commands are reads and idempotent cache operations, listed by `listWordPressCliCommands`; anything else answers `422` naming the whole list. ⛔ `config get` and `config list` are **deliberately absent** — they read `wp-config.php`, whose constants include the database password and the authentication salts. ⛔ A **non-zero `exit_code` still answers `200`.** The console's product is what WP-CLI said, and mapping a bad argument onto a 4xx would put our error page over the diagnosis the customer asked for. A `422` means *we* refused the command, which is a different answer. ⛔ The command travels in the **body**, not the path, so it never reaches a proxy or edge access log — `option get` names options a plugin may have stored a credential in. ⛔ **Fleet only** — refused where `wp_cli` is `false`. Requires `sites.view` and `sites.panel_access`.

Parametreler

Ad	Tür	Zorunlu	Ne olduğu
`siteId (path)`	`Uuid`	Evet	Site ID (UUIDv7).

İstek gövdesi

Ad	Tür	Zorunlu	Ne olduğu
`command`	`string`	Evet	The WP-CLI command, with or without a leading `wp`.

Yanıt

Ad	Tür	Zorunlu	Ne olduğu
`argv`	`string[]`	Evet	What actually ran, after the allow-list normalised it — echoed back so `wp plugin list` and `plugin list` are visibly the same command.
`exit_code`	`integer`	Evet	WP-CLI's exit code. `0` is success.
`stdout`	`string`	Evet	What WP-CLI printed, up to the console's cap.
`stderr`	`string`	Evet	WP-CLI's diagnostics, carried separately and never merged into `stdout` — WP-CLI writes PHP notices here on runs that succeed, so folding them together would corrupt the JSO…
`truncated`	`boolean`	Evet	True when `stdout` was cut at the cap. ⛔ Stated rather than hidden: a silently cut-off JSON document is worse than none, because it nearly parses.

Bu uç noktanın dönderebileceği hatalar

401 · 403 · 404 · 422 · 429 · 503

POST /v1/sites/{siteId}/wordpress/cli