WHH
WahPress
Download
Master REST API v1

Every install connects back to a control plane.

Double-gated auth: Bearer token (constant-time compare) plus per-token IP/CIDR whitelist.

Authentication

Bearer + IP/CIDR. Two gates, zero exceptions.

Tokens are generated per admin user under Settings → Master API. Each token carries its own whitelist. A request must pass both gates to proceed.

Bearer token

hash_equals constant-time string comparison. Timing attacks don't leak token prefixes.

IP / CIDR whitelist

Per-token IPv4 or CIDR entries. X-Forwarded-For chain walked with trusted-proxy list.

CORS + Debug

Debug mode returns full request payloads. OPTIONS preflight returns per-origin Allow headers.

cURL
GET /wah-api/v1/site
Host: client-site-a.example.com
Authorization: Bearer whp_E4F291B3A7C6D5E8F01A2B3C4D5E6F7A8B9C0D1E2F3A4B5C6D7E8F9A0B1C2D3E4F5A6
Content-Type: application/json
Accept: application/json
Token whitelist must include requesting IP or CIDR block or this returns 403 immediately — before the token compare runs.
Endpoint Map

6 resources × 12 endpoints.

Every write requires a POST/PUT/DELETE with a valid token and an IP in the whitelist. GET is read-only but still double-gated.

Site

2 endpoints

GET
/wah-api/v1/site

Fetch site identity, post/page counts, active theme slug.

PUT
/wah-api/v1/site

Update site name, description, admin email, posts_per_page.

Posts

2 endpoints

GET
/wah-api/v1/posts

List posts with status, author, date filters. Pagination via ?page=2.

POST
/wah-api/v1/posts

Create a published post with title, content, excerpt, tags array.

Pages

2 endpoints

GET
/wah-api/v1/pages

List or get a single page by slug. Includes parent menu_order.

PUT
/wah-api/v1/pages/:id

Update page content, template, menu order, published status.

Users

2 endpoints

GET
/wah-api/v1/users

List all users with role, user_status, display_name, email_hash.

DELETE
/wah-api/v1/users/:id

Soft-delete (suspend) a user. Reassign posts to another user_id.

Themes

2 endpoints

GET
/wah-api/v1/themes

List installed themes with versions, active flag, screenshot URL.

POST
/wah-api/v1/themes

Install a theme via zip_b64 payload OR zip_url TLS-validated pull.

Options

2 endpoints

GET
/wah-api/v1/options

Bulk fetch autoloaded options. Pass ?keys=k1,k2 for filtered fetch.

POST
/wah-api/v1/options

Bulk set key/value pairs. Types preserved via mixed serialization.

Theme Install

Two push-pull paths into the API.

The POST /wah-api/v1/themes endpoint accepts two mutually-exclusive payload shapes. One pushes a base64 zip, the other pulls from a signed URL.

zip_b64 push

Control plane base64-encodes the zip and ships it inline. Best for small themes (< 4 MB). Max payload size matches upload_max_filesize.

{
"method": "zip_b64",
"theme_slug": "wah-pro",
"zip_b64": "UEsDBBQAAAAIAH...3,400,000 more chars"
}

zip_url TLS-validated pull

WahPress fetches the zip itself over HTTPS. Certificate chain validated against system CA store. 30-second connect timeout.

{
"method": "zip_url",
"theme_slug": "wah-pro",
"zip_url": "https://cdn.wahpress.com/themes/wah-pro-v2.1.4.zip",
"expected_sha256": "a7f2c1e4...c91d"
}
Example Response

A 200 OK from the Site resource.

Same styled monospace block as the home page integration section. Every endpoint responds with ok, a data envelope, and request_id for tracing.

200 OK · 34 ms
GET /wah-api/v1/site → Response
{
"ok": true,
"name": "Client Site A",
"posts": 128,
"theme": "wah-default"
}
Connecting your control plane?

Want us to build a connector?

We ship first-party SDKs in Node, PHP, and Go. Need a custom connector for your provisioning system, billing panel, or CI/CD pipeline? We build them.

Email hello@wahpress.comBack to Docs Hub