REST API

Every Mantle endpoint lives under the mantle/v1 namespace. REST_Base composes that namespace from a base path of mantle and a version of v1, so all controllers inherit it.

Authentication

Mantle's routes are cookie-and-nonce authenticated like the rest of the WordPress REST API, and each route declares a permission_callback that checks a Mantle capability. From the browser, use the nonce WordPress already provides; from a script, use an authentication plugin appropriate to your site.

Accept: application/jsonX-WP-Nonce: REPLACE_WITH_REST_NONCE

{
  "maintenance_enabled": false,
  "security_enabled": false,
  "hosting_provider": ""
}

Enumerate the routes on your own site

Because the surface is module-dependent, list it rather than trusting a static table:

wp eval '$r = rest_get_server()->get_routes(); foreach ( $r as $route => $h ) { if ( 0 === strpos( $route, "/mantle/v1" ) ) { echo $route . PHP_EOL; } }'

/mantle/v1
/mantle/v1/settings
/mantle/v1/settings/reset
/mantle/v1/modules
...

Core routes

Registered by controllers in includes/Controller/REST/, independent of module state.

Settings

setting_key matches [a-zA-Z0-9_]+. String values are sanitised with sanitize_text_field() unless the key is in the controller's textarea allow-list.

Setup and connection

pin matches exactly four digits (\d{4}).

Modules

module_id matches [a-zA-Z0-9_-]+.

Capabilities, roles, and users

Licence and deployment

WAF

Plugin and theme commands

Module routes

These are registered through get_rest_controllers() when their module initialises, so they exist only while the owning module is enabled — with the AI Chatbot group noted below as an exception.

Convergence Cache (convergence_cache)

Monitoring (monitoring)

identifier matches [0-9]+. Note that the history sub-route has no trailing slash while its siblings do.

Plugin Sync (plugin_sync)

Client Info (client_info, core)

AI Chatbot

id matches [0-9]+.

Communication (communication)

channel_name matches \d+. The users route accepts an ids argument; attachments handles uploads. Both are declared to the front end by Communication_Module as usersRoute and attachmentsRoute.

Linchpin Licenses (linchpin_licenses)

Adding routes from a module

Override get_rest_controllers() on your module. Mantle registers the returned controllers when the module initialises, so the routes automatically disappear when the module is disabled.

/** * REST controllers owned by this module. * * @return array */protected function get_rest_controllers(): array {	return [		new Reports_REST(),	];}

Abstract_Module declares get_rest_controllers() as protected and returns an empty array by default, so override it with the same visibility.

See Creating a module for the full module contract.