REST API

The framework registers REST routes under each consuming plugin’s prefix ({prefix}/v1/...). All routes go through SettingsController::checkPermission() — the page’s capability plus the standard WP REST nonce.

Settings endpoints

Used by the page’s save / reset / load flow.

Method	Endpoint	Purpose
`GET`	`/{prefix}/v1/settings/{pageId}`	Return the config + resolved values for first render.
`POST`	`/{prefix}/v1/settings/{pageId}`	Validate, sanitise, merge, and save.
`DELETE`	`/{prefix}/v1/settings/{pageId}`	Reset the user’s editable fields to their defaults.

pageId is default in single-page mode, or the page’s id in multi-page mode.

POST returns 403 rest_cannot_save and DELETE returns 403 rest_cannot_reset when {prefix}/can_save / {prefix}/can_reset resolve to false.

See Save & Reset for the merge semantics that distinguish a full overwrite from a per-user scoped save.

Table endpoints

The table field type registers these routes per table per page:

Method	Endpoint	Purpose
`GET`	`/{prefix}/v1/table/{pageId}/{fieldId}`	Paginated row fetch. Dispatches via `…/table/{...}/data` filter.
`POST`	`/{prefix}/v1/table/{pageId}/{fieldId}/action/{actionId}`	Run a row / bulk action. Dispatches via per-action filter.
`GET`	`/{prefix}/v1/table/{pageId}/{fieldId}/entry/{id}`	Load + render a single entry for the detail view.
`GET`	`/{prefix}/v1/table/{pageId}/{fieldId}/export`	Full filtered dataset as CSV, returned as `{ download }`. 403 unless `args.export` is set.

Each dispatch slot is hooks-first with a legacy callback fallback for back-compat — see Hooks & Filters.

Row-fetch query parameters

Parameter	Type	Notes
`page`	`int`	1-indexed page number. Defaults to `1`.
`per_page`	`int`	Page size. Defaults to `10`.
`search`	`string`	Free-text search term. Defaults to `''`.
`orderby`	`string`	Column id to sort on. Defaults to `''` (no sort).
`order`	`string`	`asc` or `desc`. Defaults to `asc`.
`filters`	`JSON`	URL-encoded JSON of `{ [columnId]: value }` pairs. Defaults to `{}`.

Row-fetch response shape

{
    "items": [ /* row objects */ ],
    "total": 4823
}

Action endpoints

action fields and header actions register these routes per page:

Method	Endpoint	Purpose
`POST`	`/{prefix}/v1/action/{pageId}/{fieldId}/{actionId}`	Dispatch a button press to its filter handler.
`POST`	`/{prefix}/v1/header_action/{pageId}/{actionId}`	Dispatch a header button press. 403 for link buttons or users without `edit` access.

The request body carries the in-flight form values:

{
    "values": {
        "target_user": 42,
        "email":       "hello@example.com"
    }
}

The server sanitises every declared key, drops unknown ones, then fires:

{prefix}/action/{pageId}/{fieldId}/{actionId}

See Action Field for the full handler contract and response shape.

Permission gate

All endpoints use the same gate: the page’s capability (default manage_options) plus the standard WP REST nonce. When the page opts into Role-Based Access, the gate switches to read plus a per-element check.