REST resources

Premium builds add authenticated management routes for observations, audit records and undo, retention, scans, backfill jobs, reusable segments, and saved-rule inbound credentials. Inspect the WordPress REST index on the installed version for the exact methods and argument schemas.

Signed inbound requests

The public /inbound/{key} route does not use WordPress-user authentication. It validates the request’s HMAC signature, timestamp, nonce, and rate limit. Possession of the endpoint URL alone is not authentication.

Generate and rotate credentials from the saved inbound rule. Never expose the secret in browser code, documentation screenshots, logs, or support messages. See Signed inbound triggers for the signing contract.