Work with public resources, private operations, CLI commands, and publishing integrations.

How it works

REST API

Route	Access
`GET /wp-json/cybermaps/v1/discovery`	Public while the AI Publication Hub is enabled
`GET /wp-json/cybermaps/v1/health`	Bounded public health while the hub is enabled
`GET /wp-json/cybermaps/v1/mcp/server-card`	Public while the hub and MCP are enabled
`POST /wp-json/cybermaps/v1/mcp`	Optional MCP transport; mode, caller authentication, scopes, and capability checks govern operations
`GET /wp-json/cybermaps/v1/llms-tldr`	Public while both the hub and budgeted briefing are enabled
`GET /wp-json/cybermaps/v1/search`	Public while the hub is enabled
`GET /wp-json/cybermaps/v1/urls`	`X-Cybermaps-Secret`
`GET /wp-json/cybermaps/v1/status`	`X-Cybermaps-Secret`
`GET /wp-json/cybermaps/v1/audit-latest`	`X-Cybermaps-Secret`
`GET /wp-json/cybermaps/v1/audit-run?run_id=…`	`X-Cybermaps-Secret`
`POST /wp-json/cybermaps/v1/purge`	Logged-in administrator with `manage_options`

Private JSON responses send non-cacheable headers. The API secret is generated locally, displayed in Advanced settings, redacted from CLI status, and included in site-configuration backups.

The OAuth controller registers additional routes under /wp-json/cybermaps/v1 when its MCP integration is active. These are separate from the registry’s generated REST route list:

OAuth route	Contract
`GET /oauth/authorization-server`	Authorization-server metadata
`GET /oauth/protected-resource`	Protected-resource metadata
`GET /oauth/authorize`	Begin authorization with a logged-in WordPress user
`POST /oauth/authorize`	Complete the nonce-bound consent transaction
`POST /oauth/token`	Validate a supported grant and issue credentials
`POST /oauth/revoke`	Process a validated revocation request
`POST /oauth/device-authorization`	Device flow, gated by `user_claimed` registration
`POST /oauth/clients`	Administrator-authorized client registration

MCP uses scoped OAuth credentials, not the private X-Cybermaps-Secret read API credential. Publication of metadata does not grant permission to execute tools.

WP-CLI

The complete endpoint reference includes the editor translation route and IndexNow verification alongside these REST interfaces. The LLMS-TLDR REST route shares publication build locks and work limits with the text route; a build that cannot finish returns a retryable HTTP 503.

wp cybermaps status
wp cybermaps clear_cache
wp cybermaps flush_rules
wp cybermaps regenerate

IndexNow

When enabled, Cybermaps queues a content URL when it enters, changes within, or leaves the eligible published sitemap inventory, including deletion. The durable database queue deduplicates same-host URLs, records retry state, and builds bounded submissions. Each non-blocking request sends the public URL, host, site-specific IndexNow key, and key-location URL to https://api.indexnow.org/indexnow. While enabled, /{key}.txt serves the site key to GET and HEAD requests with a one-day public cache header. If frontend_base_url points to a different host, IndexNow requires that public frontend to proxy or publish the same generated /{key}.txt verification path; the key location must be on the host whose URLs are submitted.

WebSub

When WebSub and AI Publishing are enabled, the JSON Feed at /feed.json is the one canonical topic. Cybermaps sends non-blocking publish notifications after an eligible post is published, updated, becomes included or excluded, or is deleted. The JSON Feed contains JSON Feed 1.1 WebSub hub descriptors; dynamic responses also advertise exactly one rel="self" topic plus the configured rel="hub" links. The feed remains dynamic in every Static File Engine mode so its media type and discovery contract do not depend on server configuration. The hub list accepts up to 10 unique validated HTTPS URLs.