Docs

Admin REST API

Last updatedView as Markdown

The admin screen reads and writes everything through routes under consepo-csp-scanner/v1/admin/. They exist for that screen; they are hidden from the REST index and are not a public API.

Authentication and caching

  • Every route requires the manage_options capability. Anyone else gets consepo_csp_scanner_forbidden with status 401 or 403.
  • Authenticate as a logged-in administrator with the X-WP-Nonce header carrying a wp_rest nonce, as @wordpress/api-fetch does.
  • Responses in this namespace carry Cache-Control: no-store, no-cache, must-revalidate, max-age=0, Pragma: no-cache and X-Robots-Tag: noindex, nofollow.
  • Errors are WordPress REST errors (code, message, data.status). Errors from Consepo are translated, so Consepo rejecting a token is a 400 here, not a 401 that would read as an expired WordPress session.

Routes

MethodRouteDoes
GET/admin/statusEverything the Overview shows: connection, scan, policy and integrity counts
GET/admin/connectionThe connection without the token: connected, method, token (set or missing), connectedAt, expiresAt, oauthAvailable, redirectUri
POST/admin/connectionConnect with api_key, after Consepo accepts it
DELETE/admin/connectionDisconnect, revoking OAuth tokens when Consepo offers revocation
POST/admin/connection/oauthBegin signing in with Consepo; returns authorizeUrl
POST/admin/connection/oauth/callbackFinish signing in with the code and state Consepo returned
GET/admin/scanThe site's scan, its directives and sources, crawl findings, last policy and report address
POST/admin/scanStart the site's scan, or re-run it in place
POST/admin/scan/refreshAsk Consepo for the scan's current state
GET/admin/settingsThe settings, the header they produce (preview), the last Consepo policy and the report address
POST/admin/settingsSave changed settings; returns the same shape as GET
GET/admin/integrityThe asset inventory, counts by status, and the pinning settings
DELETE/admin/integrityForget the inventory; pinning stops until assets are seen again
POST/admin/integrity/discoverLoad the home page once and record its assets; returns the inventory plus discovered
POST/admin/integrity/rehashHash entries again: local files now, remote ones on the next background run
POST/admin/hashesHash content, or the file at url

Parameters

Reference

Request parameters

JSON body fields. Every other route takes none.
9 fields
api_key string required
POST /admin/connection. A Consepo token: csp_ followed by 48 lowercase hex characters.
code string required
POST /admin/connection/oauth/callback. The authorization code Consepo returned.
state string required
POST /admin/connection/oauth/callback. Must match the attempt this user started in the last ten minutes.
limit number
POST /admin/scan. Most pages to crawl, 1 to 100.
Default10
depth number
POST /admin/scan. Most links to follow, 1 to 10.
Default10
settings object required
POST /admin/settings. Any subset of the keys in Settings; others are ignored.
ids array
POST /admin/integrity/rehash. Entry ids from GET /admin/integrity. Empty means every entry.
Default[]
content string
POST /admin/hashes. Up to 2 MB, hashed exactly as sent.
url url
POST /admin/hashes. A public http or https URL; takes precedence over content.

Example: hash an inline script

Request POST /wp-json/consepo-csp-scanner/v1/admin/hashes
HeadersKey: value
Content-Type application/jsonX-WP-Nonce <wp_rest nonce>
Request bodyJSON
{
  "content": "alert('Hello, world.');"
}
Response 200 OK
BodyJSON
{
  "source": "content",
  "bytes": 23,
  "hashes": [
    {
      "algorithm": "sha256",
      "base64": "qznLcsROx4GACP2dm0UCKCzCG+HiZ1guq6ZZDob/Tng=",
      "sri": "sha256-qznLcsROx4GACP2dm0UCKCzCG+HiZ1guq6ZZDob/Tng=",
      "csp": "'sha256-qznLcsROx4GACP2dm0UCKCzCG+HiZ1guq6ZZDob/Tng='"
    },
    {
      "algorithm": "sha384",
      "base64": "H8BRh8j48O9oYatfu5AZzq6A9RINhZO5H16dQZngK7T62em8MUt1FLm52t+eX6xO",
      "sri": "sha384-H8BRh8j48O9oYatfu5AZzq6A9RINhZO5H16dQZngK7T62em8MUt1FLm52t+eX6xO",
      "csp": "'sha384-H8BRh8j48O9oYatfu5AZzq6A9RINhZO5H16dQZngK7T62em8MUt1FLm52t+eX6xO'"
    },
    {
      "algorithm": "sha512",
      "base64": "Q2bFTOhEALkN8hOms2FKTDLy7eugP2zFZ1T8LCvX42Fp3WoNr3bjZSAHeOsHrbV1Fu9/A0EzCinRE7Af1ofPrw==",
      "sri": "sha512-Q2bFTOhEALkN8hOms2FKTDLy7eugP2zFZ1T8LCvX42Fp3WoNr3bjZSAHeOsHrbV1Fu9/A0EzCinRE7Af1ofPrw==",
      "csp": "'sha512-Q2bFTOhEALkN8hOms2FKTDLy7eugP2zFZ1T8LCvX42Fp3WoNr3bjZSAHeOsHrbV1Fu9/A0EzCinRE7Af1ofPrw=='"
    }
  ]
}

Replace <wp_rest nonce> with a nonce from wp_create_nonce( 'wp_rest' ) for a logged-in administrator. The same request with url instead of content also returns url, contentType, cors and volatile.

Have a question about this page?

Linchpin assistant

Was this helpful?