REST API

All REST routes register under the namespace cartbay/v1.

Public Capture

POST /wp-json/cartbay/v1/capture

Purpose: create, update, or delete a consented checkout capture.

Permission: public.

Protection: RateLimiter::check('capture') before capture work.

Arguments:

Argument	Type	Notes
email	string	Sanitized and validated email.
consent	boolean	true captures; false withdraws and deletes active capture.
cart	object/array	Restore-safe client cart fallback.
source	string	classic or block.
session_id	string	Optional existing CartBay session ID.

Admin Analytics

GET /wp-json/cartbay/v1/analytics?days=30

Permission: manage_woocommerce.

Allowed days: 7, 30, 90.

Returns analytics generated by AnalyticsService.

License Routes Pro

These routes are registered by the CartBay Pro add-on, not the free plugin. All require manage_woocommerce.

Method	Path	Purpose
POST	/wp-json/cartbay/v1/license/activate	Activate a WPAnchorBay license key.
GET	/wp-json/cartbay/v1/license/status	Read local/current license status.
POST	/wp-json/cartbay/v1/license/deactivate	Remove/deactivate local license state.

Test Routes

All require manage_woocommerce.

Method	Path	Purpose
POST	/wp-json/cartbay/v1/test/trigger	Requires Test Mode; creates a dummy abandoned session and near-term email job.
POST	/wp-json/cartbay/v1/test/email	Sends a basic test email or recovery email preview by step.

Query-Arg Recovery Endpoints

Restore and unsubscribe are intentionally not REST routes.

Query arg	Handler	Purpose
?cartbay_restore={token}	template_redirect	Restore cart and redirect to checkout.
?cartbay_unsubscribe={token}	init	Suppress email and cancel future work.

Integration Notes

• Public capture protection is rate limiting, nonce origin checks, a server-side cart requirement, and a per-session token — not authentication.
• Admin routes must use real WordPress capabilities; nonce checks are not authorization.