WordPress Management

Manage plugins, themes, users, and core WordPress settings on your site
directly through the API — the same operations you'd run with wp-cli over
SSH, without needing SSH access.

How it works

Every WordPress operation is asynchronous:

You call an endpoint — e.g. activate a plugin.

The API responds immediately with 202 Accepted and a command id.

You poll GET /environments/{id}/wordpress/commands/{commandId} until
status is COMPLETED or FAILED, then read the result.

What you can do

Area	Operations
Core	Check version, check for updates, update WordPress, update the database
Plugins	List, install (from wp.org or a URL), update, activate, deactivate, delete
Themes	List, install, update, activate, delete
Users	List, view, create, update, delete, manage roles, reset a password
Options	View and update WordPress site options directly
Search & replace	Find and replace a string across your database — useful when migrating a domain
Database	Check, repair, and optimize the database; view its size
Transients	View or clear cached (transient) values

Every operation is validated against a fixed, safe set of commands and
arguments — there's no way to run arbitrary shell commands through this API.

Sensitive actions require confirmation

Actions with a big impact — updating WordPress core, deleting a user,
granting the administrator role, resetting a password — require you to pass
"confirm": true in the request body.

If you leave it out, the request is rejected with a clear error instead of
running. This gives you a chance to double-check before something
irreversible happens:

Search & replace works a little differently: without confirm, it
always runs as a safe preview (--dry-run) so you can see what would change
before committing to it. Add "confirm": true once you're ready for the
real run.

Protecting sensitive data

Listing or viewing users never returns password data.

Site options that look sensitive (containing words like pass, secret,
token, or key) can't be read through this API — but they can still be
written, since you already have full control over your own site's data.

Any option key can be added, updated, or deleted — there's no restricted
list. Options that back a specific feature (site URL, active theme, plugin
list) usually have a dedicated endpoint that's a better fit, since it
applies the change the way WordPress expects (e.g. running the relevant
activation hooks) rather than just overwriting a raw value.

Database access is limited to maintenance and size reporting — there's no
way to export, import, or run arbitrary queries through this API.

Transients can only be read or cleared, never written — there's no way to
set an arbitrary cached value through this API.

Full reference

See the WordPress section of the API reference for the complete list of
endpoints, parameters, and response formats.

WordPress Management

WordPress Management#

How it works#

What you can do#

Sensitive actions require confirmation#

Protecting sensitive data#

Full reference#

WordPress Management

How it works

What you can do

Sensitive actions require confirmation

Protecting sensitive data

Full reference