DeepGravity API Manager 0.0.6 is the current build, available now on deepgrav.com on the annual plan: $50/year, including the current build and updates released during the term. Fulfilment is through your store account and download.
Requires WordPress 6.0+ and PHP 8.0.
What it does
WordPress publishes a full map of its REST API at /wp-json/ — every namespace, every route, every method — to anyone who asks, no login needed. API Manager puts you in charge of that map.
It discovers: it scans your site’s full REST surface and inventories every namespace and route, classifying each namespace as admin (every route requires authentication) or public (at least one route is publicly accessible). It decides: a settings page under Settings > API Manager lists every namespace with its classification and route count and a visibility toggle, and new admin namespaces follow your default policy — Hidden by default. It enforces: a filter on the public index strips hidden namespaces for unauthenticated visitors, while logged-in users see the full index unchanged, and public content routes (posts, pages, media, oEmbed, ActivityPub) stay visible. And it operates: the same configuration is available through the plugin’s own REST API (dg-api-mgr/v1) — list namespaces, set visibility, trigger a scan, check status — with every endpoint requiring the manage_options capability, so an AI agent can operate the tool with no browser, a human can use the settings page, or both together.
The plugin’s own namespace appears in the visibility map like any other. It is classified admin and hidden from guests under the default policy. The inspector inspects itself.
What is new in 0.0.6: the licensing client
Version 0.0.6 integrates the licensing client for our own licensing system into the plugin. It is the first product integrated with that system, and it ships in the plugin under lib/.
Settings > API Manager gains a “License & updates” section. Enter the license key from your store account and saving it activates this site. The settings page shows your anonymous site ID and a status line, and carries a control to reset the site ID — resetting it deactivates the old identity at the authority and generates a fresh one.
The privacy design is four fields, by construction. The only data that ever leaves your site in a licensing check is the license key, an anonymous (resettable) site ID, the product name, and the installed version. The event log on the server side records the field names received — and in the verified staging battery, every keyed check event carried exactly those four field names, nothing else. No domain, no URL, no admin email, no content, no telemetry.
With a valid key stored, feature updates arrive through the gated channel. Security releases flow over the public channel whether or not a key is stored, so security patching reaches every install. With no key stored, the client adds no notices and no behaviour beyond the public-channel check on the normal WordPress update cycle. If the licensing authority is unreachable, updates simply pause; nothing breaks.
A lapsed or revoked key stops feature updates and never affects the installed copy. There is no deactivation, disable, or feature-gating logic anywhere in the client or the integration. The installed software keeps working.
Uninstall in 0.0.6 also removes the licensing client’s options, alongside the inventory, visibility map, and settings the plugin has always removed on deletion. Deactivating alone keeps your data, as before.
There are no REST endpoints for license operations in this build. Key management happens only through the settings page.
The three versions
The core of API Manager is platform-agnostic, Apache License 2.0, and free — it computes over plain arrays with no WordPress dependency. The WordPress plugin around it is GPLv2 or later, free, donationware, updated for WordPress compatibility revisions and security patches. This subscription build is the development trunk, where changes land as they happen.
The full manual is published with this release, and support is at support@deepgrav.com.
By Dora
Leave a Reply