REST API

All endpoints live under /wp-json/spacebay/v1/ and use standard WordPress cookie authentication with the X-WP-Nonce header.

Endpoint	Method	Who
/me	GET	Anyone. Returns the current member or logged_in: false.
/settings	GET, POST, PUT	Administrators.
/auth/login	POST	Visitors, while the community login pages are on. Returns logged_in with a redirect address, or a second step when an add-on asks for one (the code step of Pro).
/auth/signup	POST	Visitors, while signing up is on.
/auth/forgot, /auth/reset	POST	Visitors. Forgot always gives the same answer, whether the account exists or not.
/auth/social/{provider}, /auth/social/{provider}/callback	GET	Visitors, while that provider (google or facebook) is switched on and has its keys; otherwise the route answers 404. The first sends the browser to the provider and takes an optional redirect_to. The second is the address the provider sends the visitor back to; it logs them in (or asks for a second step) and redirects to the portal. These are browser redirects, not JSON calls.
/me/security, /me/password	GET, PUT	Logged-in members. Changing the password needs the current one.
/me/stats	GET	Logged-in members. Their own activity totals: posts, comments, likes received and joined spaces.
/me/pulse	GET	Logged-in members. Unread messages and notifications, plus what add-ons add (with Pro, calls ringing for them).
/conversations, /conversations/{id}	GET, POST, PATCH	Members in the conversation. POST starts a one-to-one chat or group within the messaging rules; PATCH renames a group or mutes it.
/conversations/{id}/messages, /conversations/{id}/read	GET, POST	Members in the conversation. GET takes before, after and limit.
/conversations/{id}/members, /conversations/{id}/members/{user_id}	POST, DELETE	Group owner adds and removes people; anyone can remove themselves.
/messages/{id}	DELETE	The author, or a moderator.
/messages/recipients, /me/blocks	GET, POST	Logged-in members.
/admin/stats	GET	Administrators.
/spaces	GET, POST	GET: anyone who can open the community (only spaces they may see). POST: administrators.
/spaces/{id}, /spaces/slug/{slug}	GET, PATCH, DELETE	GET: people who may see the space. PATCH: space admins. DELETE: administrators.
/spaces/{id}/join, /spaces/{id}/leave	POST	Logged-in members.
/spaces/{id}/members	GET, POST	GET active members: logged-in members who may read the space, while the member directory is on (space admins always). Hidden profiles are left out. Other lists and POST (invite): space admins.
/spaces/{id}/members/{user_id}	PATCH, DELETE	Space admins.
/space-groups, /space-groups/{id}	POST, PATCH, DELETE	Administrators.
/spaces/reorder, /space-groups/reorder	POST	Administrators. Send ids, a list of IDs in the new order.
/members, /members/{id}	GET	Logged-in members, when the directory is on.
/feed	GET	Anyone who can open the community. Only posts in spaces they may read. Filters: space_id, user_id, topic, hashtag, bookmarked, search, orderby. The X-WP-Total header is the exact number of posts; send count_total=false (since 1.0.0, what the portal does) to skip that count on large communities: the header then gives the posts up to this page, plus one when another page follows.
/posts	POST	Members who may post in the space.
/posts/{id}	GET, PATCH, DELETE	GET: readers of the space. PATCH and DELETE: the author and space moderators.
/posts/{id}/like, /bookmark, /pin	POST	Like: space members. Save: logged-in readers. Pin: space moderators.
/posts/{id}/comments	GET, POST	GET: readers of the space. POST: space members.
/comments/{id}, /comments/{id}/like	PATCH, DELETE, POST	Edit and delete: the author and space moderators. Like: space members.
/media	POST	Logged-in members. One image per request in the file field.
/topics, /topics/{id}	GET, POST, PATCH, DELETE	GET: anyone who can open the community. Changes: administrators.
/me/profile	GET, PATCH	Logged-in members, for their own profile.
/me/avatar, /me/cover	POST, DELETE	Logged-in members. POST one image in the file field.
/me/email-preferences	GET, PUT	Logged-in members.
/notifications, /notifications/count	GET	Logged-in members, for their own notifications. Filter: unread.
/notifications/read	POST	Logged-in members. Send ids or all: true.
/reports	POST	Logged-in members. object_type (post, comment, member, message), object_id, reason, optional note.
/moderation/counts, /moderation/queue	GET	Moderators.
/moderation/queue/{type}/{id}	POST	Moderators. action: approve or remove.
/moderation/members, /moderation/members/{id}	GET, POST	Moderators. List pending or suspended members; POST status: active or blocked.
/moderators, /moderators/{id}	GET, POST, DELETE	Administrators.
/admin/setup	GET, POST	Administrators. Setup wizard state and starter spaces.
/leaderboard	GET	Logged-in members, while the leaderboard is on. period: week, month or all; limit up to 50.
/me/points	GET	Logged-in members, their own points history. Paged.
/events	GET, POST	GET: anyone who can open the community; only events in spaces they may read. Filters: space_id, when (upcoming, past, range), from and to (up to 62 days), rsvp=going, page, per_page. POST: members who may add events in the space.
/events/{id}	GET, PATCH, DELETE	GET: readers of the space. PATCH and DELETE: the organizer and space moderators.
/events/{id}/cancel	POST	The organizer and space moderators.
/events/{id}/rsvp	POST	Members of the space. answer: going, maybe, not_going, or empty to remove it.
/events/{id}/attendees	GET	Readers of the space. answer: going or maybe. Paged.
/search	GET	Anyone who can open the community. Parameters: q (2 to 100 characters), type (all, posts, spaces, members), page.

Endpoints added by SpaceBay Pro Pro

These endpoints exist only while SpaceBay Pro is active. They use the same /wp-json/spacebay/v1/ base.

Endpoint	Method	Who
/auth/two-factor, /auth/two-factor/status, /auth/two-factor/send	POST	Visitors in the code step of a login.
/me/two-factor, /me/two-factor/app, /me/two-factor/email, /me/two-factor/confirm, /me/two-factor/backup-codes	POST, DELETE	Logged-in members, for their own account. Every change except confirm needs the current password.
/members/{id}/two-factor	DELETE	Administrators who may edit that user.
/conversations/{id}/calls, /calls/{id}, /calls/{id}/join|decline|leave, /calls/{id}/signals	GET, POST	People invited to the call, while calls are on.
/profile-fields	GET, PUT	GET: logged-in members. PUT: administrators.
/members/{id}/badges	POST	Admins and community moderators. badge (key) and on (true to give, false to take away).
/members/{id}/points	POST	Community managers. points (−10,000 to 10,000, not 0) and an optional note.
/shop/products, /shop/products/{id}, /shop/featured, /shop/sellers/{id}	GET	Anyone who can open the community, while shops are on. Only published products of open shops; sellers and admins also see their pending and rejected products.
/shop/me, /shop/request	GET, POST	Logged-in members, for their own shop.
/shop/products, /shop/products/{id}, /shop/media	POST, DELETE	Sellers with an open shop, for their own products (sellers can delete their own products when the shop is closed), and community managers.
/shop/admin/summary, /shop/admin/sellers, /shop/admin/sellers/{id}, /shop/admin/products, /shop/admin/products/{id}/review, /shop/admin/products/{id}/placement	GET, POST	Community managers.