Developer APIs & PWAREST8 min read•Updated October 2026
REST API & AJAX Endpoint Reference
Complete API reference for bookings, leads, invoices, e-sign contracts, and PWA push subscriptions.
All endpoints are accessible via platform REST API (/wp-json/cora/v1/ or /wp-json/cora-pwa/v1/ or /wp-json/cora-mcp/v1/) and standard AJAX actions.
1. Authentication & Nonces
- REST Requests: Require
X-WP-Nonceheader or Bearer API token. - AJAX Requests: Require
nonce: coraREWPData.ajaxNoncein POST body. - MCP & OAuth Requests: Require
Authorization: Bearer <token>issued via OAuth 2.1 PKCE.
2. API Endpoints Table
| Method | Route / Action | Required Permission | Description |
|---|---|---|---|
GET | /cora-api/v1/projects | cora_view_dashboard | Query published case studies with industry, tag, and status filters |
GET | /cora-api/v1/projects/{slug} | Public | Retrieve single 4-act project case study, numerical KPIs, and testimonial |
GET | /wp-json/cora/v1/invoices | cora_manage_financials | Fetch agency tax invoices |
POST | /wp-json/cora/v1/invoices | cora_manage_financials | Create 18% GST invoice |
GET | /wp-json/cora/v1/forms/all-submissions | cora_view_dashboard | Fetch all workspace form submissions with form metadata JOINed |
DELETE | /wp-json/cora/v1/forms/submissions/{id} | cora_manage_bookings | Securely delete single form submission record |
POST | /wp-json/cora/v1/referrals/track | Public | Record affiliate referral impressions, clicks, and checkout conversions |
POST | /wp-json/cora/v1/contracts/sign | Public (Token-Based) | Submit SHA-256 e-signature |
POST | /wp-json/cora-pwa/v1/save-subscription | Authenticated User | Store VAPID Web Push subscription |
GET | /wp-json/cora-pwa/v1/version-check | Public | Query active workspace version & changelog |
GET | /wp-json/cora-mcp/v1/openapi.json | Public | OpenAPI 3.0.1 schema (curated 28 tools ceiling; ?all=1 for full registry) |
POST | /wp-json/cora-mcp/v1/rpc | Bearer Token (OAuth 2.1) | MCP JSON-RPC 2.0 tool execution gateway |
GET | /wp-json/cora-mcp/v1/tools | Bearer Token (OAuth 2.1) | Canonical tool registry and capabilities |
GET | /.well-known/oauth-authorization-server | Public | RFC 8414 & RFC 9728 OAuth 2.1 server metadata |
GET | /api/health | Public | Production edge deployment and AI agent health probe |
POST | /api/ai-preview | Public | Sticky AI SDR query handler with objection vector analysis & coupon dispatch |
POST | /api/partner-application | Public | Partner & creator coaching accelerator enrollment intake |
3. GitHub CI/CD AJAX Actions
| AJAX Action | Method | Description |
|---|---|---|
cora_github_initiate_device_flow | POST | Initiate OAuth 2.0 device flow authentication |
cora_github_poll_device_token | POST | Poll token exchange state for active device code |
cora_github_create_branch | POST | Create isolated feature/theme branch |
cora_github_create_pr | POST | Generate GitHub Pull Request with change summary |
cora_github_get_prs | POST | Fetch list of active pull requests and review states |
cora_github_merge_pr | POST | Safely merge approved pull request into main branch |
cora_github_revert_commit | POST | Revert target commit SHA with automated rollback |
cora_github_sync_entire_workspace | POST | Atomically commit and sync all workspace themes to GitHub |
cora_github_provision_org_repo | POST | Provision new dedicated theme repository under organization |
Have questions about this module?
Our founding engineering team answers developer inquiries directly.