REST API Reference

Complete reference for the LicenceForge REST API. All endpoints are registered under the wplf/v1 namespace and are available at https://your-site.com/wp-json/wplf/v1/.

Authentication

Admin endpoints accept two authentication methods:

API keys have three permission levels: read, write, and admin. Each endpoint lists its minimum required permission.

Public endpoints

These endpoints are called by the client library on end-user sites or by external systems. No authentication is required unless noted otherwise.

Health check

Response

{
  "status": "healthy",
  "checks": [
    { "name": "database", "status": "pass" },
    { "name": "file_storage", "status": "pass" },
    { "name": "stripe_webhook", "status": "pass" }
  ]
}

Validate licence

Parameters

Response

{
  "valid": true,
  "status": "active",
  "expires": "2026-03-15T00:00:00Z",
  "activation_limit": 5,
  "activation_count": 2,
  "already_activated": true,
  "product_version": "2.1.0",
  "is_trial": false,
  "trial_ends": null,
  "tier": {
    "label": "Business",
    "features": ["priority-support", "white-label", "multisite"]
  }
}

Activate licence

Parameters

Deactivate licence

Parameters

Check for updates

Parameters

Download product

Parameters

Request trial

Parameters

Stripe webhook receiver

Admin endpoints

All admin endpoints require authentication via cookie or API key. The minimum permission level is listed for each endpoint.

Products

Licences

List filters

The GET /wplf/v1/admin/licenses endpoint supports the following query parameters:

API keys

Statistics

Privacy (GDPR)

Error responses

All error responses follow a consistent JSON structure:

{
  "code": "license_not_found",
  "message": "No licence was found matching the provided key.",
  "data": {
    "status": 404
  }
}

Common error codes

Rate limiting

Rate limits are applied per IP address for public endpoints and per API key for admin endpoints. When a limit is exceeded, the API returns HTTP 429 with the following headers:

Limits summary

Example requests

Validate a licence (cURL)

curl -X POST https://your-site.com/wp-json/wplf/v1/licenses/validate \
  -H "Content-Type: application/json" \
  -d '{
    "license_key": "wplf_abc123...",
    "product_slug": "my-plugin",
    "site_url": "https://customer-site.com"
  }'

List licences with API key (cURL)

curl -X GET "https://your-site.com/wp-json/wplf/v1/admin/licenses?status=active&per_page=50" \
  -H "Authorization: Bearer wplf_k1_your_api_key_here"

Create a licence (cURL)

curl -X POST https://your-site.com/wp-json/wplf/v1/admin/licenses \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer wplf_k1_your_api_key_here" \
  -d '{
    "product_id": 1,
    "price_id": 3,
    "customer_email": "[email protected]",
    "customer_name": "Jane Smith",
    "activation_limit": 5,
    "status": "active"
  }'

Related pages

• API Keys -- How to create and manage API keys in the admin panel
• Rate Limiting -- Configuration and tuning guide
• Public Endpoints (Guide) -- Narrative guide with integration walkthroughs
• Admin Endpoints (Guide) -- Narrative guide for admin API usage
• Hooks Reference -- Server and client hooks that fire during API calls
• Database Schema -- Underlying table structures for API responses
• Privacy & GDPR -- Details on the export and erasure endpoints