API Manager Manual

Version 0.0.6. Requires WordPress 6.0 or higher, and PHP 8.0 or higher.

DeepGravity API Manager decides what your site’s public REST API index advertises. WordPress publishes a full map of its REST API at /wp-json/ — every namespace, every route, every method — to anyone who asks, no login needed. This plugin inventories that surface, classifies each namespace, and strips the namespaces you hide from what guests see. Logged-in users always see the full index unchanged.

Install

1. Upload the dg-api-mgr folder to /wp-content/plugins/, or install the zip via Plugins > Add New > Upload Plugin.
2. Activate the plugin through the Plugins screen.
3. On activation the plugin queues its first scan, which runs automatically on the next REST request and builds the inventory. Open Settings > API Manager to review the namespaces and adjust visibility, or leave the defaults — admin namespaces are hidden from guests, public namespaces stay visible.

If you bought the annual plan on deepgrav.com, fulfilment is through your store account and download on that site. The licensing client is included in 0.0.6 — see “License & updates” below.

First scan

The first scan is queued on activation and runs on the next REST request; it does not run inline during activation. The scan inventories every namespace and route your site’s REST server has registered, and classifies each namespace:

• Admin — every route in the namespace requires authentication.
• Public — at least one route in the namespace is publicly accessible. The inventory records the first guest-accessible route that made the namespace classify public, so the classification can be explained.

Further scans run weekly via WP-Cron, and on demand with the “Rescan now” control on the settings page. When a scan discovers a new namespace, it classifies it and assigns visibility: public namespaces become visible, and admin namespaces follow your default policy.

A scan that runs outside the REST-index request context cannot prune namespaces it cannot see — some plugins register routes only in particular request contexts — so unseen namespaces are carried over unchanged rather than treated as removed.

Settings

All settings are on Settings > API Manager.

The page lists every inventoried namespace with its classification and route count, and a visibility toggle (Public / Hidden) for each one.

• Default policy for new admin namespaces — what happens to a newly discovered admin namespace. Hidden is the default, and the safe choice. Public namespaces always stay visible by default.
• Rescan now — runs a fresh scan on demand.
• License & updates — see the next section.

Settings are stored as WordPress options on your own site.

Visibility: how enforcement works

Enforcement is a filter on the public index at /wp-json/. For an unauthenticated (guest) request, the filter strips every namespace whose effective visibility is Hidden, from both the namespaces list and the routes list in the index document. For a logged-in user, the filter does not run in a way that changes anything: authenticated users see the full index, unchanged.

Hiding a namespace removes it from the discovery document only. The endpoints themselves keep working exactly as before for anyone who knows their URL and has the right credentials.

Public content routes (posts, pages, media) and federation routes (ActivityPub, oEmbed) are classified public and stay visible, so federation and embedding keep working.

The filter reads one small cached option and passes over the index arrays once. It runs only for unauthenticated requests to /wp-json/, and no scanning happens inside the filter.

The plugin’s own namespace, dg-api-mgr/v1, appears in the visibility map like any other namespace. It is classified admin and hidden from guests under the default policy. Authenticated users still see it.

License & updates

Version 0.0.6 includes the licensing client. Settings > API Manager gains a “License & updates” section: enter the license key from your store account, and saving it activates this site.

The only data that ever leaves your site in a licensing check is four fields: the license key, an anonymous (resettable) site ID, the product name, and the installed version. The anonymous site ID is stored as a WordPress option on your own site, and you can reset it from the settings page; resetting it deactivates the old identity and generates a fresh one.

Feature updates arrive through the gated channel when a valid key is stored. Security releases flow over the public channel whether or not a key is stored. A lapsed or revoked key stops feature updates and never affects the installed copy. With no key stored, the client adds no notices and no behaviour beyond the public-channel check on the normal WordPress update cycle.

The license key and the anonymous site ID are stored as ordinary WordPress options on your own site, and uninstall removes them — see “Deletion” below.

License operations happen through the settings page. There are no REST endpoints for license operations.

Operating through the REST API

Every function on the settings page has an equivalent in the plugin’s own REST API, in the dg-api-mgr/v1 namespace:

• GET /namespaces — list namespaces.
• POST /namespaces/{namespace}/visibility — set a namespace’s visibility.
• POST /scan — trigger a scan.
• GET /status — check status.

All endpoints require the manage_options capability. An AI agent with those credentials can read the inventory, change visibility, and trigger scans without a browser. The set-visibility endpoint reads the namespace from the URL parameters only.

That gives three operation modes: all-user (settings page only), all-AI (REST API only), and hybrid — you decide, your agent executes.

Deactivation

Deactivating the plugin unschedules the weekly scan and stops the filter — guests see the full public index again, as WordPress ships it. Your inventory, visibility map, and settings are kept, so reactivating restores everything. Reactivation also refreshes the inventory.

Deletion

Deleting the plugin removes its stored data entirely: the inventory, visibility map, and settings, and — in 0.0.6 — the licensing client’s options as well, including the stored license key and anonymous site ID. Deactivating alone keeps them; deleting does not.

Frequently asked questions

Will hiding a namespace from the index break my site? No. Hiding a namespace from the public index only removes it from the discovery document at /wp-json/. The endpoints themselves keep working exactly as before for anyone who knows their URL and has the right credentials. Public content routes (posts, pages, media) and federation routes (ActivityPub, oEmbed) are classified public and stay visible by default.

Why is a public namespace listed as “Hidden” by default? It should not be. Namespaces classified public are always visible by default. If a public namespace shows as hidden, either its classification changed (a plugin update removed its public routes) or someone set it hidden by hand. Check the classification column; a public namespace marked hidden is worth a look before you change it back.

A new plugin added a namespace. What happens? The next scan (weekly, or the next time you press “Rescan now”) discovers it, classifies it, and assigns visibility: public namespaces become visible, admin namespaces follow your default policy (Hidden by default). Until the scan runs, an undiscovered namespace follows the default policy in the filter.

Does the filter slow down the site? No. The filter reads one small cached option and passes over the index arrays once. It runs only for unauthenticated requests to /wp-json/. No scanning happens inside the filter.

Can an AI agent manage this plugin? Yes. Every function on the settings page has an equivalent in the plugin’s REST API (dg-api-mgr/v1): GET /namespaces, POST /namespaces/{namespace}/visibility, POST /scan, GET /status. All endpoints require manage_options. An agent with those credentials can read the inventory, change visibility, and trigger scans without a browser.

What happens if I deactivate the plugin? The weekly scan is unscheduled and the filter stops running — guests see the full public index again, as WordPress ships it. Your inventory, visibility map, and settings are kept, so reactivating restores everything.

What happens if I delete the plugin? Deleting removes the inventory, visibility map, and settings entirely. Deactivating alone keeps them.

Support

Questions: support@deepgrav.com. Say which product and version you are running, your WordPress and PHP versions, and what you expected to see versus what you saw. Never send passwords, a license key in full, or private content.