Work with public resources, private operations, CLI commands, and publishing integrations.

How it works

REST API

Route	Access
`GET /wp-json/cybermaps/v1/discovery`	Public while the AI Publication Hub is enabled
`GET /wp-json/cybermaps/v1/health`	Bounded public health while the hub is enabled
`GET /wp-json/cybermaps/v1/mcp/server-card`	Public while the hub and MCP are enabled
`POST /wp-json/mcp/cybermaps`	Optional read-only MCP Adapter transport; explicit opt-in, WordPress authentication and read capability
`GET /wp-json/cybermaps/v1/llms-tldr`	Public while both the hub and budgeted briefing are enabled
`GET /wp-json/cybermaps/v1/search`	Public while the hub is enabled
`GET /wp-json/cybermaps/v1/urls`	`X-Cybermaps-Secret`
`GET /wp-json/cybermaps/v1/status`	`X-Cybermaps-Secret`
`GET /wp-json/cybermaps/v1/audit-latest`	`X-Cybermaps-Secret`
`GET /wp-json/cybermaps/v1/audit-run?run_id=…`	`X-Cybermaps-Secret`
`POST /wp-json/cybermaps/v1/purge`	Logged-in administrator with `manage_options`

Private JSON responses send non-cacheable headers. The API secret is generated locally, displayed in Advanced settings, redacted from CLI status, and included in site-configuration backups.

Cybermaps no longer registers its former MCP OAuth or device authorization routes. MCP Adapter owns transport and WordPress authentication. The separate administrator Cloudflare OAuth connection remains available. The private read API secret cannot authenticate MCP. See the MCP setup and migration guide.

WP-CLI

The complete endpoint reference includes the editor translation route and IndexNow verification alongside these REST interfaces. The LLMS-TLDR REST route shares publication build locks and work limits with the text route; a build that cannot finish returns a retryable HTTP 503.

wp cybermaps status
wp cybermaps clear_cache
wp cybermaps flush_rules
wp cybermaps regenerate

IndexNow

When enabled, Cybermaps queues a content URL when it enters, changes within, or leaves the eligible published sitemap inventory, including deletion. The durable database queue deduplicates same-host URLs and records retry state. A queue worker sends a bounded batch to https://api.indexnow.org/indexnow and waits for the response with a five-second request timeout so it can record acceptance or schedule a retry. The request includes the public URLs, host, site-specific IndexNow key, and key-location URL. While enabled, /{key}.txt serves the site key to GET and HEAD requests with a one-day public cache header. If frontend_base_url points to a different host, IndexNow requires that public frontend to proxy or publish the same generated /{key}.txt verification path; the key location must be on the host whose URLs are submitted.

WebSub

When WebSub and AI Publishing are enabled, the JSON Feed at /feed.json is the one canonical topic. Cybermaps sends non-blocking publish notifications after an eligible post is published, updated, becomes included or excluded, or is deleted. The JSON Feed contains JSON Feed 1.1 WebSub hub descriptors; dynamic responses also advertise exactly one rel="self" topic plus the configured rel="hub" links. The feed remains dynamic in every Static File Engine mode so its media type and discovery contract do not depend on server configuration. The hub list accepts up to 10 unique validated HTTPS URLs.