WPCentrify REST API and webhooks

Getting started

The API is a JSON REST API over HTTPS, and sits alongside the rest of the product documentation. Authenticate with a bearer token generated in the dashboard under Settings, then API tokens. Tokens carry the same role scoping as team members, so a read-only token cannot trigger an update.

curl https://api.wpcentrify.com/v1/sites \
  -H "Authorization: Bearer $WPC_TOKEN" \
  -H "Accept: application/json" 

WordPress management API core resources

• GET /v1/sites list connected sites with health, versions and tags
• GET /v1/sites/{id} full detail for a single site
• GET /v1/updates pending updates across the portfolio, with risk scores
• POST /v1/updates/{id}/apply apply an update, optionally forcing staging validation
• GET /v1/backups backup inventory including restore-test status
• POST /v1/backups/{id}/restore trigger a restore, full or selective
• GET /v1/incidents availability incidents with duration and cause context
• GET /v1/vulnerabilities findings matched to your installed versions
• GET /v1/activity the full activity log, filterable and paginated
• GET /v1/reports generated client reports and their underlying data

Webhooks

Register an endpoint and receive events as they happen. Every payload is signed with an HMAC-SHA256 signature in the X-WPC-Signature header, and failed deliveries are retried with exponential backoff for 24 hours.

{
  "event": "update.rolled_back",
  "occurred_at": "2026-08-25T03:41:12Z",
  "site": { "id": "st_8fk2", "url": "harvest-collective.store" },
  "update": { "plugin": "elementor", "from": "3.31.1", "to": "3.31.2" },
  "reason": "visual_regression",
  "detail": { "template": "product", "delta": 0.184, "threshold": 0.02 },
  "restore_point": "bk_20260825_0339",
  "duration_seconds": 41
}

Available events

• update.applied, update.failed, update.rolled_back, update.held
• backup.completed, backup.failed, backup.restore_tested
• site.down, site.recovered, site.degraded
• vulnerability.detected, vulnerability.patched
• report.generated, report.sent
• ssl.expiring, domain.expiring

Rate limits and conventions

• Rate limits are 600 requests per minute per token, with remaining quota returned in response headers.
• All list endpoints are cursor paginated and return next_cursor when more results exist.
• Timestamps are ISO 8601 in UTC. Money is returned in minor units with an explicit currency.
• Errors return a machine-readable code alongside a human-readable message.
• The API is versioned in the path. Breaking changes ship as a new version with at least twelve months of overlap.