API reference

Which API should I use?

Authentication

REST — application passwords

Create one at Users → Profile → Application Passwords, then send it as HTTP Basic. Reads of published content need no auth; writes do.

curl -u "admin:xxxx xxxx xxxx xxxx xxxx xxxx" \
  "https://cms.bowtiekreative.com/wp-json/wp/v2/projects"

app/v1 — shared secret

Header X-App-Secret, matching APP_SHARED_SECRET in wp-config. Server-to-server only — never expose it to a browser. Every route 401s without it.

curl -H "X-App-Secret: $WP_SHARED_SECRET" \
  "https://cms.bowtiekreative.com/wp-json/app/v1/auth/users"

REST CRUD

Base: https://cms.bowtiekreative.com/wp-json/wp/v2

Endpoints by type

Taxonomies: /wp/v2/app_capability and /wp/v2/app_industry.

Create a project

curl -X POST "https://cms.bowtiekreative.com/wp-json/wp/v2/projects" \
  -u "$WP_USER:$WP_APP_PASSWORD" \
  -H "Content-Type: application/json" \
  -d '{
    "title":   "Northside Coffee Rebrand",
    "slug":    "northside-coffee",
    "status":  "publish",
    "content": "<p>A full identity refresh.</p>",
    "meta": {
      "app_project_client":       "Northside Coffee",
      "app_project_year":         2026,
      "app_project_featured":     true,
      "app_project_deliverables": ["Logo system","Packaging"]
    }
  }'

Update just one field

curl -X POST "https://cms.bowtiekreative.com/wp-json/wp/v2/projects/7" \
  -u "$WP_USER:$WP_APP_PASSWORD" \
  -H "Content-Type: application/json" \
  -d '{"meta":{"app_project_year":2027}}'

meta is merged, not replaced — keys you omit keep their value.

Custom fields

Meta Box fields are exposed under meta byapp-rest-fields.php. They use their raw ids there, unlike GraphQL where the shared prefix is stripped — app_project_client in REST is projectDetails.client in GraphQL.

Images are attachment IDs. Upload first via POST /wp/v2/media, then write the returned id. GraphQL resolves the same fields to full objects with url, alt and dimensions.

GraphQL

POST https://cms.bowtiekreative.com/graphql · explore it inGraphiQL. Introspection is disabled for unauthenticated requests by default, which is why GraphiQL runs inside wp-admin.

curl -X POST "https://cms.bowtiekreative.com/graphql" \
  -H "Content-Type: application/json" \
  -d '{"query":"{ project(id: \"northside-coffee\", idType: SLUG) {
        title
        frontendPath
        projectDetails {
          client
          year
          deliverables
          gallery { url alt width height }
        }
      } }"}'

Meta Box groups appear as one object field each. Values resolve lazily, so a field you don't ask for costs no database read. Cursor pagination: projects(first: 100, after: $cursor) — WPGraphQL capsfirst at 100.

App endpoints

Base: https://cms.bowtiekreative.com/wp-json/app/v1 · all require X-App-Secret.

Webhooks this app receives

Webhooks are the only thing that grants a subscription. Unverified events are rejected with 400; a handler failure returns 500 so the provider retries.

Status codes

WordPress errors come back as { code, message, data: { status } }. Failed logins always say the same thing regardless of whether the account exists.