# REST API, WP-CLI, and integrations

Work with public resources, private operations, CLI commands, and publishing integrations.

Work with public resources, private operations, CLI commands, and publishing integrations.

## How it works

### REST API

| Route | Access |
| --- | --- |
| `GET /wp-json/cybermaps/v1/discovery` | Public while the AI Publication Hub is enabled |
| `GET /wp-json/cybermaps/v1/health` | Bounded public health while the hub is enabled |
| `GET /wp-json/cybermaps/v1/mcp/server-card` | Public while the hub and MCP are enabled |
| `POST /wp-json/cybermaps/v1/mcp` | Optional MCP transport; mode, caller authentication, scopes, and capability checks govern operations |
| `GET /wp-json/cybermaps/v1/llms-tldr` | Public while both the hub and budgeted briefing are enabled |
| `GET /wp-json/cybermaps/v1/search` | Public while the hub is enabled |
| `GET /wp-json/cybermaps/v1/urls` | `X-Cybermaps-Secret` |
| `GET /wp-json/cybermaps/v1/status` | `X-Cybermaps-Secret` |
| `GET /wp-json/cybermaps/v1/audit-latest` | `X-Cybermaps-Secret` |
| `GET /wp-json/cybermaps/v1/audit-run?run_id=…` | `X-Cybermaps-Secret` |
| `POST /wp-json/cybermaps/v1/purge` | Logged-in administrator with `manage_options` |

Private JSON responses send non-cacheable headers. The API secret is generated locally, displayed in Advanced settings, redacted from CLI status, and included in site-configuration backups.

The OAuth controller registers additional routes under `/wp-json/cybermaps/v1` when its MCP integration is active. These are separate from the registry’s generated REST route list:

| OAuth route | Contract |
| --- | --- |
| `GET /oauth/authorization-server` | Authorization-server metadata |
| `GET /oauth/protected-resource` | Protected-resource metadata |
| `GET /oauth/authorize` | Begin authorization with a logged-in WordPress user |
| `POST /oauth/authorize` | Complete the nonce-bound consent transaction |
| `POST /oauth/token` | Validate a supported grant and issue credentials |
| `POST /oauth/revoke` | Process a validated revocation request |
| `POST /oauth/device-authorization` | Device flow, gated by `user_claimed` registration |
| `POST /oauth/clients` | Administrator-authorized client registration |

MCP uses scoped OAuth credentials, not the private `X-Cybermaps-Secret` read API credential. Publication of metadata does not grant permission to execute tools.

### WP-CLI

The [complete endpoint reference](https://cybermaps.dev/docs/endpoints/) includes the editor translation route and IndexNow verification alongside these REST interfaces. The LLMS-TLDR REST route shares publication build locks and work limits with the text route; a build that cannot finish returns a retryable HTTP 503.

*   `wp cybermaps status`
*   `wp cybermaps clear_cache`
*   `wp cybermaps flush_rules`
*   `wp cybermaps regenerate`

### IndexNow

When enabled, Cybermaps queues a content URL when it enters, changes within, or leaves the eligible published sitemap inventory, including deletion. The durable database queue deduplicates same-host URLs, records retry state, and builds bounded submissions. Each non-blocking request sends the public URL, host, site-specific IndexNow key, and key-location URL to `https://api.indexnow.org/indexnow`. While enabled, `/{key}.txt` serves the site key to GET and HEAD requests with a one-day public cache header. If `frontend_base_url` points to a different host, IndexNow requires that public frontend to proxy or publish the same generated `/{key}.txt` verification path; the key location must be on the host whose URLs are submitted.

### WebSub

When WebSub and AI Publishing are enabled, the JSON Feed at `/feed.json` is the one canonical topic. Cybermaps sends non-blocking publish notifications after an eligible post is published, updated, becomes included or excluded, or is deleted. The JSON Feed contains JSON Feed 1.1 `WebSub` hub descriptors; dynamic responses also advertise exactly one `rel="self"` topic plus the configured `rel="hub"` links. The feed remains dynamic in every Static File Engine mode so its media type and discovery contract do not depend on server configuration. The hub list accepts up to 10 unique validated HTTPS URLs.