WP Event API — Manage Events via REST

Object‑oriented WordPress plugin that registers an event custom post type and exposes CRUD operations over the REST API. Only administrators (capability manage_options) can call these endpoints by default.

Endpoints (namespace: wp-event-api/v1)

• POST /events/create — create an event
• POST /events/update/<event_id> — update an event
• GET /events/list?date=<YYYY-MM-DD> — list events for a date
• GET /events/show?id=<event_id> — fetch a single event
• DELETE /events/delete/<event_id> — delete an event

All endpoints return JSON WP_REST_Response objects with proper HTTP status codes.

Authentication (Application Passwords)

1. In wp‑admin, open your admin user profile.
2. Scroll to “Application Passwords” and click “Add New Application Password”.
3. Build the string <username>:<generated 24‑char password> and Base64 encode it.
4. Send the header:

Authorization: Basic <base64(username:password)>

Example:

Authorization: Basic YWRtaW46WXFtTSBnU2R5IHV2aFIgY0o5RyBaUVRLIHl6ZlY=

Request examples (cURL)

Create:

curl -X POST \
  -H "Authorization: Basic <base64>" \
  -H "Content-Type: application/json" \
  -d '{"title":"Launch","description":"Kickoff","start_date_time":"2026-01-10","end_date_time":"2026-01-11","category":"Releases"}' \
  https://example.com/wp-json/wp-event-api/v1/events/create

Update:

curl -X POST \
  -H "Authorization: Basic <base64>" \
  -H "Content-Type: application/json" \
  -d '{"title":"Launch v2","description":"Updated","start_date_time":"2026-01-12","end_date_time":"2026-01-13","category":"Releases"}' \
  https://example.com/wp-json/wp-event-api/v1/events/update/123

Webhook support

The plugin can notify external systems when events change.

Triggers:

• created — after a new event is created
• updated — after an event is updated
• deleted — after an event is deleted

Each webhook is a non‑blocking POST with JSON body and headers:

Content-Type: application/json
User-Agent: WPEA/<version>
X-WPEA-Event: created|updated|deleted
X-WPEA-Signature: <hmac sha256 of body using secret>   # optional if secret is set

Payload shape:

{
  "action": "created",
  "ts": 1733577600,
  "site": { "url": "https://example.com/", "name": "Site", "lang": "en_US" },
  "plugin": { "slug": "wp-event-api", "version": "1.0.0" },
  "payload": {
    "event_id": 123,
    "title": "Launch",
    "start_date_time": "2026-01-10",
    "end_date_time": "2026-01-11"
  }
}

Configure endpoints

Option (database‑backed):

update_option( 'wpea_webhooks', array(
	'created' => array( 'https://example.com/hooks/events-created' ),
	'updated' => array( 'https://example.com/hooks/events-updated' ),
	'deleted' => array( 'https://example.com/hooks/events-deleted' ),
) );

// Optional signing secret
update_option( 'wpea_webhook_secret', 'your-strong-shared-secret' );

Filter (code‑based):

add_filter( 'wpea_webhook_endpoints', function( $endpoints, $action ) {
	if ( 'created' === $action ) {
		$endpoints[] = 'https://example.com/hooks/created';
	}
	return $endpoints;
}, 10, 2 );

Data model

• Post type: event (supports title, editor; visible in REST)
• Taxonomy: event_cat (hierarchical; visible in REST)
• Meta: start_date_time, end_date_time

Notes

• Only users with manage_options may call the endpoints by default (filterable in code).
• Date validation: start must be in the future; end must be greater than start.