WordPress Sites Endpoint

Live GET endpoint for WordPress site inventory.

This endpoint returns WordPress site inventory as JSON. It is useful for dashboards, audits, provider portals, support checks, monitoring jobs, and automation that needs to observe PanelConfig state without opening the GUI.

Endpoint

Field	Value
Availability	Available in current source.
HTTP method	GET
Endpoint URL	`/api/v1/wordpress-sites.php`
Authentication	Bearer token required. The token must belong to an active user and must not be expired or revoked.
Published/recommended scope label	`websites.read`
Current scope enforcement note	The source stores scope labels, but this endpoint file does not call a central scope-check helper in the inspected build.
Role/access level	Active authenticated user. Admin users see broader records where the endpoint code allows it; non-admin users are account-filtered on many resource endpoints.
Rate limit	120 requests / 60 seconds
Primary data read	`wordpress_sites`

Headers

Header	Required	Value
Authorization	Yes	`Bearer pc_YOUR_TOKEN`
Accept	Recommended	`application/json`

Path

None. This is a collection-style file endpoint in the current build.

Query

No formal query parameters are documented from the source for this endpoint. The route returns a recent list or computed summary based on the SQL query inside the file.

Request Body

No request body is used. Sending a JSON body to this GET endpoint is unnecessary.

Request

curl -s https://panel.example.com/api/v1/wordpress-sites.php \
  -H "Authorization: Bearer pc_YOUR_TOKEN" \
  -H "Accept: application/json"

Success Response

{
  "success": true,
  "message": "PanelConfig API resource loaded.",
  "data": {
    "resource": "wordpress-sites",
    "items": []
  },
  "timestamp": "2026-06-19T00:00:00+00:00"
}

Status Codes

Status	Meaning
200	Request succeeded.
401	Bearer token missing, invalid, expired, or attached to an inactive user.
403	The token user is authenticated but not admin-capable where this endpoint requires an admin-capable user.
429	Rate limit exceeded where the endpoint calls the rate-limit helper.
500	Unexpected application, PHP, or database failure.

Records

This endpoint is read-only for the resource it returns. For authenticated endpoints, the auth helper updates api_tokens.last_used_at and inserts a row into api_requests when that table exists.

Audit Logging

Read endpoints do not call the audit helper for the returned resource. Use API request logs and token last-used timestamps to review API activity. Token creation itself is audited by the token creation helper.

Panel UI

PCAdmin → WordPress / PCUser → WordPress

PCCLI

Use PCCLI list or health commands where available for local server automation. Treat API and PCCLI output as complementary: API for remote JSON clients, PCCLI for on-server shell workflows.

Security Notes

Use HTTPS.
Do not expose bearer tokens in client-side code.
Create a separate token for each external system.
For admin-only endpoints, restrict which operator accounts can create and own tokens.

Troubleshooting

Run /api/v1/me.php first to confirm the token works.
Check the HTTP status code and the JSON message.
For empty items, verify that records exist and that the token user has account visibility.
For 429, reduce polling frequency and retry after the rate window.

← Websites Endpoint WordPress Tasks Endpoint →