REST API
Admin-only REST routes under stalza-security/v1 used by the React console.
All routes live under wp-json/stalza-security/v1 and require manage_options.
Core
| Method | Path | Purpose |
|---|---|---|
| GET | /status |
Edition, feature flags, plugin version |
| GET / PUT | /settings |
Allowlisted settings tree |
| GET | /dashboard |
Dashboard summary cards |
Modules
Each module registers its own routes (scans, findings, lockouts, events, vulnerabilities, hardening). Names match the admin tabs. Responses use a { data } envelope (lists also include meta pagination).
License (Pro build only)
| Method | Path | Purpose |
|---|---|---|
| GET | /license |
Status, masked key, seat usage |
| POST | /license/activate |
Body { key } |
| POST | /license/deactivate |
Clear this site |
| POST | /license/validate |
Force revalidation |
Free builds do not register these routes.
Errors
Failures return a WP_Error with code prefix stalza_sec_ and an HTTP status in data.status.