Automattic Protect API
The protect API from Automattic — 3 operation(s) for protect.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/automattic-protect-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
OpenAPI Specification
openapi: 3.2.0
info:
title: WordPress.com REST API v1.1 Protect API
version: v1.1
description: 'The WordPress.com REST API, operated by Automattic. Derived by API Evangelist from Automattic''s own self-describing help document at https://public-api.wordpress.com/rest/v1.1/help (Accept: application/json), which publishes every endpoint''s method, path, description, path/query/body parameters and response fields. Security schemes come from https://public-api.wordpress.com/.well-known/openid-configuration. The error envelope was observed live.'
termsOfService: https://wordpress.com/tos/
contact:
name: WordPress.com Developer Resources
url: https://developer.wordpress.com/docs/api/
x-derived-from: https://public-api.wordpress.com/rest/v1.1/help
x-derived-by: API Evangelist enrichment pipeline
servers:
- url: https://public-api.wordpress.com/rest/v1.1
security:
- bearerAuth: []
tags:
- name: protect
paths:
/sites/{site}/protect/recovery/confirm:
post:
operationId: postSitesBySiteProtectRecoveryConfirm
summary: A site confirms that a user can bypass jetpack to try to login and login
description: A site confirms that a user can bypass jetpack to try to login and login
tags:
- protect
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'401':
description: Authorization required
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'403':
description: Forbidden
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'404':
description: Not found
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
parameters:
- name: site
in: path
required: true
schema:
type: string
description: The site's id or domain
- name: context
in: query
required: false
schema:
type: string
enum:
- display
- edit
description: 'display: (default) Formats the output as HTML for display. Shortcodes are parsed, paragraph tags are added, etc..; edit: Formats the output for editing. Shortcodes are left unparsed, significant whitespace is kept, etc..'
- name: http_envelope
in: query
required: false
schema:
type: boolean
description: 'false: (default); true: Some environments (like in-browser JavaScript or Flash) block or divert responses with a non-200 HTTP status code. Setting this parameter will force the HTTP status code to always be 200. The JSON response is wrapped in an "envelope" containing the "real" HTTP status code and headers.'
- name: pretty
in: query
required: false
schema:
type: boolean
description: 'false: (default); true: Output pretty JSON'
- name: meta
in: query
required: false
schema:
type: string
description: 'Optional. Loads data from the endpoints found in the ''meta'' part of the response. Comma-separated list. Example: meta=site,likes'
- name: fields
in: query
required: false
schema:
type: string
description: 'Optional. Returns specified fields only. Comma-separated list. Example: fields=ID,title'
- name: callback
in: query
required: false
schema:
type: string
description: An optional JSONP callback function.
requestBody:
required: false
content:
application/json:
schema:
type: object
properties:
user_id:
type: integer
description: The id of the user requesting a recovery email.
ip:
type: string
description: The IP of the user requesting a recovery email.
token:
type: string
description: The recovery token.
/sites/{site}/protect/recovery/request:
post:
operationId: postSitesBySiteProtectRecoveryRequest
summary: A user request an email containing a recovery url that they can use to bypass a Protect blockage
description: A user request an email containing a recovery url that they can use to bypass a Protect blockage
tags:
- protect
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'401':
description: Authorization required
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'403':
description: Forbidden
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'404':
description: Not found
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
parameters:
- name: site
in: path
required: true
schema:
type: string
description: The site's id or domain
- name: context
in: query
required: false
schema:
type: string
enum:
- display
- edit
description: 'display: (default) Formats the output as HTML for display. Shortcodes are parsed, paragraph tags are added, etc..; edit: Formats the output for editing. Shortcodes are left unparsed, significant whitespace is kept, etc..'
- name: http_envelope
in: query
required: false
schema:
type: boolean
description: 'false: (default); true: Some environments (like in-browser JavaScript or Flash) block or divert responses with a non-200 HTTP status code. Setting this parameter will force the HTTP status code to always be 200. The JSON response is wrapped in an "envelope" containing the "real" HTTP status code and headers.'
- name: pretty
in: query
required: false
schema:
type: boolean
description: 'false: (default); true: Output pretty JSON'
- name: meta
in: query
required: false
schema:
type: string
description: 'Optional. Loads data from the endpoints found in the ''meta'' part of the response. Comma-separated list. Example: meta=site,likes'
- name: fields
in: query
required: false
schema:
type: string
description: 'Optional. Returns specified fields only. Comma-separated list. Example: fields=ID,title'
- name: callback
in: query
required: false
schema:
type: string
description: An optional JSONP callback function.
requestBody:
required: false
content:
application/json:
schema:
type: object
properties:
user_id:
type: integer
description: The id of the user requesting a recovery email.
ip:
type: string
description: The IP of the user requesting a recovery email.
/sites/{site}/protect/recovery/validate/{user_id}:
get:
operationId: getSitesBySiteProtectRecoveryValidateByUserId
summary: Validates a url emailed to a user containing a recovery toke that they can use to bypass a Protect blockage
description: Validates a url emailed to a user containing a recovery toke that they can use to bypass a Protect blockage
tags:
- protect
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'401':
description: Authorization required
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'403':
description: Forbidden
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'404':
description: Not found
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
parameters:
- name: site
in: path
required: true
schema:
type: string
description: The site's id or domain
- name: user_id
in: path
required: true
schema:
type: string
description: The user id
- name: context
in: query
required: false
schema:
type: string
enum:
- display
- edit
description: 'display: (default) Formats the output as HTML for display. Shortcodes are parsed, paragraph tags are added, etc..; edit: Formats the output for editing. Shortcodes are left unparsed, significant whitespace is kept, etc..'
- name: http_envelope
in: query
required: false
schema:
type: boolean
description: 'false: (default); true: Some environments (like in-browser JavaScript or Flash) block or divert responses with a non-200 HTTP status code. Setting this parameter will force the HTTP status code to always be 200. The JSON response is wrapped in an "envelope" containing the "real" HTTP status code and headers.'
- name: pretty
in: query
required: false
schema:
type: boolean
description: 'false: (default); true: Output pretty JSON'
- name: meta
in: query
required: false
schema:
type: string
description: 'Optional. Loads data from the endpoints found in the ''meta'' part of the response. Comma-separated list. Example: meta=site,likes'
- name: fields
in: query
required: false
schema:
type: string
description: 'Optional. Returns specified fields only. Comma-separated list. Example: fields=ID,title'
- name: callback
in: query
required: false
schema:
type: string
description: An optional JSONP callback function.
- name: token
in: query
required: false
schema:
type: string
description: The recovery token.
- name: action
in: query
required: false
schema:
type: string
description: What action to redirect the to.
components:
schemas:
Error:
type: object
description: WordPress.com REST API error envelope (observed live).
properties:
error:
type: string
examples:
- not_found
message:
type: string
securitySchemes:
oauth2:
type: oauth2
description: WordPress.com OAuth 2.1 (see /.well-known/openid-configuration).
flows:
authorizationCode:
authorizationUrl: https://public-api.wordpress.com/oauth2-1/authorize
tokenUrl: https://public-api.wordpress.com/oauth2-1/token
refreshUrl: https://public-api.wordpress.com/oauth2-1/token
scopes:
global: ''
auth: ''
openid: ''
profile: ''
email: ''
users: ''
sites: ''
posts: ''
comments: ''
taxonomy: ''
follow: ''
sharing: ''
freshly-pressed: ''
notifications: ''
insights: ''
read: ''
stats: ''
media: ''
menus: ''
batch: ''
videos: ''
bearerAuth:
type: http
scheme: bearer
description: 'Authorization: Bearer <access_token>'