Complete REST API reference for Data Machine.

Overview

Base URL: /wp-json/datamachine/v1/

Authentication: WordPress application password, WordPress admin cookie authentication, or endpoint-specific bearer-token authentication where noted.

Permissions: REST controllers use DataMachineAbilitiesPermissionHelper, not a single generic manage_options check. WordPress administrators still pass because manage_options grants the mapped Data Machine capabilities, but the canonical permissions are scoped actions such as manage_flows, manage_agents, manage_settings, chat, use_tools, view_logs, and create_own_agent.

Implementation: All REST route registrations live in inc/Api/. This inventory is sourced from register_routes() implementations in that directory.

Route Inventory

Endpoint Categories

Workflow Execution

• Execute: Trigger flows and ephemeral workflows.
• Webhook Triggers: Trigger a flow through bearer or HMAC webhook authentication.
• Agent Ping: Agent callback confirmation and polling endpoints.
• Scheduling Intervals: Available scheduling intervals and configuration.

Pipeline & Flow Management

• Pipelines
• Flows
• Jobs
• Processed Items

Agents, Memory & Chat

• Agents
• Agent Ping
• Files
• Chat
• Chat Sessions

Tools, Providers & Handlers

• Handlers
• Providers
• Tools
• Step Types

Content, Email & Analytics

• Analytics
• Email
• Internal Links

Configuration & Operations

• Auth
• Authentication
• Settings
• System
• Users
• Logs
• AI Directives

Common Patterns

Authentication

Data Machine supports three authentication shapes:

1. Application Password for external WordPress REST clients.
2. Cookie Authentication for WordPress admin sessions.
3. Endpoint-specific Bearer/HMAC auth for webhook-style callbacks that do not map cleanly to a logged-in WordPress user.

See Authentication.

Permission Resolution

PermissionHelper::can() maps Data Machine actions to concrete WordPress capabilities:

Administrators retain access through manage_options, but docs and integrations should refer to the scoped Data Machine actions above.

Error Handling

All endpoints return standardized error responses following WordPress REST API conventions. Common error codes include:

• rest_forbidden (403) – Insufficient permissions.
• rest_invalid_param (400) – Invalid parameters.
• Resource-specific errors (404, 422, 500).

See Error Handling Reference for complete error code documentation.

Pagination

Endpoints returning lists commonly support pagination parameters:

• per_page – Number of items per page.
• offset or page – Pagination offset.

Implementation Guide

REST handlers should stay thin: validate request shape, call the service or ability that owns the behavior, and return a WordPress REST response.

register_rest_route( 'datamachine/v1', '/pipelines', array(
    'methods'             => 'GET',
    'callback'            => array( Pipelines::class, 'get_pipelines' ),
    'permission_callback' => array( Pipelines::class, 'check_permission' ),
) );

For detailed implementation patterns, see the Development section for hooks and extension guides.

Related Documentation

• Authentication
• Errors
• Engine Execution
• Settings
• Development Guides

API Version: v1 Last Updated: 2026-05-12