WordPress

POST /v1/wordpress/{id}/autologin · scope wordpress:console

Logs in as the first administrator without a password. Single use, short-lived (expires_in_seconds). It is a POST because the URL is a credential: it is not cached, not replayed by Idempotency-Key, and it enters the audit log. Requires wordpress:console.

curl https://api.truo.cloud/v1/wordpress/svc_10432/autologin \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress autologin svc_10432

await truo.wordpress.autologin("svc_10432");

truo_wordpress({
  "action": "autologin",
  "id": "svc_10432"
})

operationId: wordpress.autologin

Create a backup now

POST /v1/wordpress/{id}/backups · scope wordpress:write · asynchronous · idempotent

Database and files. Counts against the daily manual-backup allowance of the plan (429 rate_limited when exceeded) and its storage quota (429 quota_exceeded). One at a time per site (409). The operation carries the backup_id in result.

curl https://api.truo.cloud/v1/wordpress/svc_10432/backups \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress backup create svc_10432

await truo.wordpress.backups.create("svc_10432");

truo_wordpress({
  "action": "backup_create",
  "id": "svc_10432"
})

operationId: wordpress.backups.create

Delete a backup

DELETE /v1/wordpress/{id}/backups/{backup_id} · scope wordpress:write · destructive — cannot be undone · idempotent

Irreversible. Scheduled backups are also pruned by the retention policy; you rarely need this.

curl https://api.truo.cloud/v1/wordpress/svc_1241/backups/wp_20260915_030000_daily \
  -X DELETE \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress backup delete svc_1241 wp_20260915_030000_daily

await truo.wordpress.backups.delete("svc_1241", "wp_20260915_030000_daily");

truo_wordpress({
  "action": "backup_delete",
  "id": "svc_1241",
  "backupId": "wp_20260915_030000_daily"
})

operationId: wordpress.backups.delete

Get a temporary download URL for a backup

POST /v1/wordpress/{id}/backups/{backup_id}/download · scope wordpress:write

The archive may have to be rebuilt from cold storage first, which can take a minute. It is a POST because the URL is a credential: it is not cached and it enters the audit log.

curl https://api.truo.cloud/v1/wordpress/svc_1241/backups/wp_20260915_030000_daily/download \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress backup download svc_1241 wp_20260915_030000_daily

await truo.wordpress.backups.download("svc_1241", "wp_20260915_030000_daily");

truo_wordpress({
  "action": "backup_download",
  "id": "svc_1241",
  "backupId": "wp_20260915_030000_daily"
})

operationId: wordpress.backups.download

List the site’s backups

GET /v1/wordpress/{id}/backups · scope wordpress:read

Newest first. Scheduled and manual ones, wherever they are stored.

curl https://api.truo.cloud/v1/wordpress/svc_10432/backups \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress backup list svc_10432

await truo.wordpress.backups.list("svc_10432");

truo_wordpress({
  "action": "backup_list",
  "id": "svc_10432"
})

operationId: wordpress.backups.list

Restore a backup

POST /v1/wordpress/{id}/backups/{backup_id}/restore · scope wordpress:write · destructive — cannot be undone · asynchronous · idempotent

Destructive: overwrites the database and the files with the backup. Everything changed since it was taken is lost. Take a fresh backup first if in doubt.

curl https://api.truo.cloud/v1/wordpress/svc_1241/backups/wp_20260915_030000_daily/restore \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress backup restore svc_1241 wp_20260915_030000_daily

await truo.wordpress.backups.restore("svc_1241", "wp_20260915_030000_daily");

truo_wordpress({
  "action": "backup_restore",
  "id": "svc_1241",
  "backupId": "wp_20260915_030000_daily"
})

operationId: wordpress.backups.restore

Get the backup schedule

GET /v1/wordpress/{id}/backups/settings · scope wordpress:read

curl https://api.truo.cloud/v1/wordpress/svc_10432/backups/settings \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress backup settings get svc_10432

await truo.wordpress.backups.settings.get("svc_10432");

truo_wordpress({
  "action": "backup_settings_get",
  "id": "svc_10432"
})

operationId: wordpress.backups.settings.get

Change the backup schedule

PUT /v1/wordpress/{id}/backups/settings · scope wordpress:write · reversible · idempotent

retention_days is clamped to the range the plan allows; the response shows what was applied.

curl https://api.truo.cloud/v1/wordpress/svc_10432/backups/settings \
  -X PUT \
  -H "Authorization: Bearer $TRUO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"enabled":true,"frequency":"daily","retention_days":1}'

truo wordpress backup settings set svc_10432

await truo.wordpress.backups.settings.update("svc_10432", {"enabled":true,"frequency":"daily","retention_days":1});

truo_wordpress({
  "action": "backup_settings_set",
  "id": "svc_10432"
})

operationId: wordpress.backups.settings.update

Flush every cache

POST /v1/wordpress/{id}/cache/flush · scope wordpress:write · idempotent

Object cache (Redis), page cache and the CDN edge if enabled. Harmless: the caches rebuild on the next visits.

curl https://api.truo.cloud/v1/wordpress/svc_10432/cache/flush \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress cache flush svc_10432

await truo.wordpress.cache.flush("svc_10432");

truo_wordpress({
  "action": "cache_flush",
  "id": "svc_10432"
})

operationId: wordpress.cache.flush

Disable the media CDN

POST /v1/wordpress/{id}/cdn/disable · scope wordpress:write · reversible · idempotent

curl https://api.truo.cloud/v1/wordpress/svc_10432/cdn/disable \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress cdn disable svc_10432

await truo.wordpress.cdn.disable("svc_10432");

truo_wordpress({
  "action": "cdn_disable",
  "id": "svc_10432"
})

operationId: wordpress.cdn.disable

Enable the media CDN

POST /v1/wordpress/{id}/cdn/enable · scope wordpress:write · reversible · idempotent

Serves uploads from the edge with on-the-fly image optimization. Media URLs are rewritten on the frontend only.

curl https://api.truo.cloud/v1/wordpress/svc_10432/cdn/enable \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress cdn enable svc_10432

await truo.wordpress.cdn.enable("svc_10432");

truo_wordpress({
  "action": "cdn_enable",
  "id": "svc_10432"
})

operationId: wordpress.cdn.enable

Get the CDN state

GET /v1/wordpress/{id}/cdn · scope wordpress:read

curl https://api.truo.cloud/v1/wordpress/svc_10432/cdn \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress cdn get svc_10432

await truo.wordpress.cdn.get("svc_10432");

truo_wordpress({
  "action": "cdn_get",
  "id": "svc_10432"
})

operationId: wordpress.cdn.get

Purge the CDN cache

POST /v1/wordpress/{id}/cdn/purge · scope wordpress:write · idempotent

curl https://api.truo.cloud/v1/wordpress/svc_10432/cdn/purge \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress cdn purge svc_10432

await truo.wordpress.cdn.purge("svc_10432");

truo_wordpress({
  "action": "cdn_purge",
  "id": "svc_10432"
})

operationId: wordpress.cdn.purge

Take your custom domains off Cloudflare

POST /v1/wordpress/{id}/cloudflare/disable · scope wordpress:write · reversible · idempotent

Removes the Cloudflare hostnames and goes back to per-domain certificates. Point your DNS at the site again.

curl https://api.truo.cloud/v1/wordpress/svc_10432/cloudflare/disable \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress cloudflare disable svc_10432

await truo.wordpress.cloudflare.disable("svc_10432");

truo_wordpress({
  "action": "cloudflare_disable",
  "id": "svc_10432"
})

operationId: wordpress.cloudflare.disable

Put your custom domains behind Cloudflare

POST /v1/wordpress/{id}/cloudflare/enable · scope wordpress:write · reversible · idempotent

Registers each custom domain with Cloudflare and switches its certificate. The operation result lists, per domain, the DNS records to publish. Until they resolve, the domain keeps working as before.

curl https://api.truo.cloud/v1/wordpress/svc_10432/cloudflare/enable \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress cloudflare enable svc_10432

await truo.wordpress.cloudflare.enable("svc_10432");

truo_wordpress({
  "action": "cloudflare_enable",
  "id": "svc_10432"
})

operationId: wordpress.cloudflare.enable

Get the Cloudflare state of every domain

GET /v1/wordpress/{id}/cloudflare · scope wordpress:read

Whether your custom domains go through Cloudflare (edge cache, DDoS protection, managed certificates) and the per-domain status. Only on sites whose capabilities.cloudflare is true.

curl https://api.truo.cloud/v1/wordpress/svc_10432/cloudflare \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress cloudflare get svc_10432

await truo.wordpress.cloudflare.get("svc_10432");

truo_wordpress({
  "action": "cloudflare_get",
  "id": "svc_10432"
})

operationId: wordpress.cloudflare.get

Get the DNS records a Cloudflare-enabled domain needs

GET /v1/wordpress/{id}/cloudflare/records · scope wordpress:read

Re-fetches the records and the current verification status from Cloudflare. Use it to check progress after publishing them.

curl https://api.truo.cloud/v1/wordpress/svc_10432/cloudflare/records \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress cloudflare records svc_10432

await truo.wordpress.cloudflare.records.get("svc_10432");

truo_wordpress({
  "action": "cloudflare_records",
  "id": "svc_10432"
})

operationId: wordpress.cloudflare.records.get

Update WordPress core

POST /v1/wordpress/{id}/core/updates · scope wordpress:write · reversible · idempotent

Updates to the latest version WordPress offers and runs the database upgrade. Take a backup first.

curl https://api.truo.cloud/v1/wordpress/svc_10432/core/updates \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress core update svc_10432

await truo.wordpress.core.updates.apply("svc_10432");

truo_wordpress({
  "action": "core_update",
  "id": "svc_10432"
})

operationId: wordpress.core.updates.apply

Check for WordPress core updates

GET /v1/wordpress/{id}/core/updates · scope wordpress:read

curl https://api.truo.cloud/v1/wordpress/svc_10432/core/updates \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress core updates svc_10432

await truo.wordpress.core.updates.list("svc_10432");

truo_wordpress({
  "action": "core_updates",
  "id": "svc_10432"
})

operationId: wordpress.core.updates.list

Unschedule a WP-Cron event

DELETE /v1/wordpress/{id}/cron/{hook} · scope wordpress:write · destructive — cannot be undone · idempotent

Removes every scheduled occurrence of the hook. A plugin may schedule it again.

curl https://api.truo.cloud/v1/wordpress/svc_1241/cron/wp_version_check \
  -X DELETE \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress cron delete svc_1241 wp_version_check

await truo.wordpress.cron.delete("svc_1241", "wp_version_check");

truo_wordpress({
  "action": "cron_delete",
  "id": "svc_1241",
  "hook": "wp_version_check"
})

operationId: wordpress.cron.delete

List scheduled WP-Cron events

GET /v1/wordpress/{id}/cron · scope wordpress:read

curl https://api.truo.cloud/v1/wordpress/svc_10432/cron \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress cron list svc_10432

await truo.wordpress.cron.list("svc_10432");

truo_wordpress({
  "action": "cron_list",
  "id": "svc_10432"
})

operationId: wordpress.cron.list

Run a WP-Cron event now

POST /v1/wordpress/{id}/cron/{hook}/run · scope wordpress:write · reversible · idempotent

curl https://api.truo.cloud/v1/wordpress/svc_1241/cron/wp_version_check/run \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress cron run svc_1241 wp_version_check

await truo.wordpress.cron.run("svc_1241", "wp_version_check");

truo_wordpress({
  "action": "cron_run",
  "id": "svc_1241",
  "hook": "wp_version_check"
})

operationId: wordpress.cron.run

Add a custom domain

POST /v1/wordpress/{id}/domains · scope wordpress:write · reversible · idempotent

Registers the domain, requests its certificate and — if it is the first custom domain — makes it the primary and rewrites the site URLs. The response says which DNS records to publish. By default the request fails if the domain does not point here yet; pass force to add it first and configure DNS afterwards.

curl https://api.truo.cloud/v1/wordpress/svc_10432/domains \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domain":"shop.example.com"}'

truo wordpress domain add svc_10432

await truo.wordpress.domains.add("svc_10432", {"domain":"shop.example.com"});

truo_wordpress({
  "action": "domain_add",
  "id": "svc_10432"
})

operationId: wordpress.domains.add

Remove a custom domain

DELETE /v1/wordpress/{id}/domains/{domain_id} · scope wordpress:write · destructive — cannot be undone · idempotent

The site stops answering on it. Its certificate is dropped. The platform hostname cannot be removed.

curl https://api.truo.cloud/v1/wordpress/svc_1241/domains/<domain_id> \
  -X DELETE \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress domain delete svc_1241 <domain_id>

await truo.wordpress.domains.delete("svc_1241", "<domain_id>");

truo_wordpress({
  "action": "domain_delete",
  "id": "svc_1241",
  "domainId": "<domain_id>"
})

operationId: wordpress.domains.delete

List the site’s domains

GET /v1/wordpress/{id}/domains · scope wordpress:read

Includes the platform hostname the site was born with and every custom domain you added.

curl https://api.truo.cloud/v1/wordpress/svc_10432/domains \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress domain list svc_10432

await truo.wordpress.domains.list("svc_10432");

truo_wordpress({
  "action": "domain_list",
  "id": "svc_10432"
})

operationId: wordpress.domains.list

Make a domain the primary

POST /v1/wordpress/{id}/domains/{domain_id}/primary · scope wordpress:write · reversible · idempotent

Rewrites siteurl/home and every URL in the database. An apex becomes www.: that is the canonical form.

curl https://api.truo.cloud/v1/wordpress/svc_1241/domains/<domain_id>/primary \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress domain set-primary svc_1241 <domain_id>

await truo.wordpress.domains.set_primary("svc_1241", "<domain_id>");

truo_wordpress({
  "action": "domain_set_primary",
  "id": "svc_1241",
  "domainId": "<domain_id>"
})

operationId: wordpress.domains.set_primary

Retry certificate issuance for every domain

POST /v1/wordpress/{id}/domains/ssl/retry · scope wordpress:write · idempotent

Clears failed certificate attempts and asks for them again. Use it after fixing DNS. Let’s Encrypt allows 5 failures per hour per domain: do not loop on this.

curl https://api.truo.cloud/v1/wordpress/svc_10432/domains/ssl/retry \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress domain retry-ssl svc_10432

await truo.wordpress.domains.ssl.retry("svc_10432");

truo_wordpress({
  "action": "domain_retry_ssl",
  "id": "svc_10432"
})

operationId: wordpress.domains.ssl.retry

Check a domain’s DNS

GET /v1/wordpress/{id}/domains/{domain_id}/verify · scope wordpress:read

Resolves the domain (and www. for an apex) and says whether it points here, or why not.

curl https://api.truo.cloud/v1/wordpress/svc_1241/domains/<domain_id>/verify \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress domain verify svc_1241 <domain_id>

await truo.wordpress.domains.verify("svc_1241", "<domain_id>");

truo_wordpress({
  "action": "domain_verify",
  "id": "svc_1241",
  "domainId": "<domain_id>"
})

operationId: wordpress.domains.verify

Get how the site sends email

GET /v1/wordpress/{id}/email · scope wordpress:read

curl https://api.truo.cloud/v1/wordpress/svc_10432/email \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress email get svc_10432

await truo.wordpress.email.get("svc_10432");

truo_wordpress({
  "action": "email_get",
  "id": "svc_10432"
})

operationId: wordpress.email.get

List recently sent emails

GET /v1/wordpress/{id}/email/log · scope wordpress:read

What wp_mail() sent in the last 7 days: recipient, subject and method. No bodies.

curl https://api.truo.cloud/v1/wordpress/svc_10432/email/log \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress email log svc_10432

await truo.wordpress.email.log("svc_10432");

truo_wordpress({
  "action": "email_log",
  "id": "svc_10432"
})

operationId: wordpress.email.log

Send a test email

POST /v1/wordpress/{id}/email/test · scope wordpress:write · idempotent

Sends through the site’s own mailer. result.sent says whether wp_mail() succeeded; a false is the diagnosis, not an error.

curl https://api.truo.cloud/v1/wordpress/svc_10432/email/test \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"to":"you@example.com"}'

truo wordpress email test svc_10432

await truo.wordpress.email.test("svc_10432", {"to":"you@example.com"});

truo_wordpress({
  "action": "email_test",
  "id": "svc_10432"
})

operationId: wordpress.email.test

Get a WordPress site with its live state

GET /v1/wordpress/{id} · scope wordpress:read

Queries the node. If it does not respond, live comes back null instead of failing: a node hiccup should not stop you from reading the rest of the resource or its capabilities.

curl https://api.truo.cloud/v1/wordpress/svc_10432 \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress get svc_10432

await truo.wordpress.get("svc_10432");

truo_wordpress({
  "action": "get",
  "id": "svc_10432"
})

operationId: wordpress.get

List WordPress sites

GET /v1/wordpress · scope wordpress:read

Served from the database, without querying the node: live comes back null. Fetching it would cost one backend call per page item. For the live state of one site, use GET /v1/wordpress/{id}.

curl https://api.truo.cloud/v1/wordpress \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress list

await truo.wordpress.list();

truo_wordpress({
  "action": "list"
})

operationId: wordpress.list

Get a log’s last lines

GET /v1/wordpress/{id}/logs · scope wordpress:read

curl https://api.truo.cloud/v1/wordpress/svc_10432/logs \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress logs svc_10432

await truo.wordpress.logs.get("svc_10432");

truo_wordpress({
  "action": "logs",
  "id": "svc_10432"
})

operationId: wordpress.logs.get

Run PageSpeed Insights

GET /v1/wordpress/{id}/monitoring/pagespeed · scope wordpress:read

Runs Google PageSpeed Insights live for mobile and desktop: 10–30 s. Core Web Vitals included.

curl https://api.truo.cloud/v1/wordpress/svc_10432/monitoring/pagespeed \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress pagespeed svc_10432

await truo.wordpress.monitoring.pagespeed("svc_10432");

truo_wordpress({
  "action": "pagespeed",
  "id": "svc_10432"
})

operationId: wordpress.monitoring.pagespeed

Get the auto-recovery state and history

GET /v1/wordpress/{id}/monitoring/recovery · scope wordpress:read

The platform watches every site and repairs the common failures on its own (plugin fatals, stuck services). This is what it did to yours, and whether it gave up (halted).

curl https://api.truo.cloud/v1/wordpress/svc_10432/monitoring/recovery \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress recovery svc_10432

await truo.wordpress.monitoring.recovery("svc_10432");

truo_wordpress({
  "action": "recovery",
  "id": "svc_10432"
})

operationId: wordpress.monitoring.recovery

Get PHP version and settings

GET /v1/wordpress/{id}/php · scope wordpress:read

curl https://api.truo.cloud/v1/wordpress/svc_10432/php \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress php get svc_10432

await truo.wordpress.php.get("svc_10432");

truo_wordpress({
  "action": "php_get",
  "id": "svc_10432"
})

operationId: wordpress.php.get

Restart PHP

POST /v1/wordpress/{id}/php/restart · scope wordpress:write · idempotent

Recycles the PHP workers and reloads the web server. No downtime; in-flight requests finish.

curl https://api.truo.cloud/v1/wordpress/svc_10432/php/restart \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress php restart svc_10432

await truo.wordpress.php.restart("svc_10432");

truo_wordpress({
  "action": "php_restart",
  "id": "svc_10432"
})

operationId: wordpress.php.restart

Change PHP settings

PATCH /v1/wordpress/{id}/php · scope wordpress:write · reversible · idempotent

Only the provided keys change. PHP reloads gracefully: no downtime.

curl https://api.truo.cloud/v1/wordpress/svc_10432/php \
  -X PATCH \
  -H "Authorization: Bearer $TRUO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'

truo wordpress php set svc_10432

await truo.wordpress.php.update("svc_10432", {});

truo_wordpress({
  "action": "php_set",
  "id": "svc_10432"
})

operationId: wordpress.php.update

Change the PHP version

POST /v1/wordpress/{id}/php/version · scope wordpress:write · reversible · idempotent

Switches the interpreter and restarts PHP: a few seconds of errors while it comes back. Custom settings carry over.

curl https://api.truo.cloud/v1/wordpress/svc_10432/php/version \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"version":"8.3"}'

truo wordpress php version svc_10432

await truo.wordpress.php.version.set("svc_10432", {"version":"8.3"});

truo_wordpress({
  "action": "php_version",
  "id": "svc_10432"
})

operationId: wordpress.php.version.set

Activate a plugin

POST /v1/wordpress/{id}/plugins/{slug}/activate · scope wordpress:write · reversible · idempotent

curl https://api.truo.cloud/v1/wordpress/svc_1241/plugins/woocommerce/activate \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress plugin activate svc_1241 woocommerce

await truo.wordpress.plugins.activate("svc_1241", "woocommerce");

truo_wordpress({
  "action": "plugin_activate",
  "id": "svc_1241",
  "slug": "woocommerce"
})

operationId: wordpress.plugins.activate

Deactivate a plugin

POST /v1/wordpress/{id}/plugins/{slug}/deactivate · scope wordpress:write · reversible · idempotent

curl https://api.truo.cloud/v1/wordpress/svc_1241/plugins/woocommerce/deactivate \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress plugin deactivate svc_1241 woocommerce

await truo.wordpress.plugins.deactivate("svc_1241", "woocommerce");

truo_wordpress({
  "action": "plugin_deactivate",
  "id": "svc_1241",
  "slug": "woocommerce"
})

operationId: wordpress.plugins.deactivate

Delete a plugin

DELETE /v1/wordpress/{id}/plugins/{slug} · scope wordpress:write · destructive — cannot be undone · idempotent

Removes its files. Its settings stay in the database, as WordPress does.

curl https://api.truo.cloud/v1/wordpress/svc_1241/plugins/woocommerce \
  -X DELETE \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress plugin delete svc_1241 woocommerce

await truo.wordpress.plugins.delete("svc_1241", "woocommerce");

truo_wordpress({
  "action": "plugin_delete",
  "id": "svc_1241",
  "slug": "woocommerce"
})

operationId: wordpress.plugins.delete

Install a plugin

POST /v1/wordpress/{id}/plugins · scope wordpress:write · reversible · idempotent

From wordpress.org by slug, or from an https:// zip. Activates it unless activate is false.

curl https://api.truo.cloud/v1/wordpress/svc_10432/plugins \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"slug":"woocommerce"}'

truo wordpress plugin install svc_10432

await truo.wordpress.plugins.install("svc_10432", {"slug":"woocommerce"});

truo_wordpress({
  "action": "plugin_install",
  "id": "svc_10432"
})

operationId: wordpress.plugins.install

List installed plugins

GET /v1/wordpress/{id}/plugins · scope wordpress:read

curl https://api.truo.cloud/v1/wordpress/svc_10432/plugins \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress plugin list svc_10432

await truo.wordpress.plugins.list("svc_10432");

truo_wordpress({
  "action": "plugin_list",
  "id": "svc_10432"
})

operationId: wordpress.plugins.list

Search wordpress.org for plugins

GET /v1/wordpress/{id}/plugins/search · scope wordpress:read

curl https://api.truo.cloud/v1/wordpress/svc_10432/plugins/search \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress plugin search svc_10432

await truo.wordpress.plugins.search("svc_10432");

truo_wordpress({
  "action": "plugin_search",
  "id": "svc_10432"
})

operationId: wordpress.plugins.search

Update a plugin

POST /v1/wordpress/{id}/plugins/{slug}/update · scope wordpress:write · reversible · idempotent

curl https://api.truo.cloud/v1/wordpress/svc_1241/plugins/woocommerce/update \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress plugin update svc_1241 woocommerce

await truo.wordpress.plugins.update("svc_1241", "woocommerce");

truo_wordpress({
  "action": "plugin_update",
  "id": "svc_1241",
  "slug": "woocommerce"
})

operationId: wordpress.plugins.update

Update every plugin with an update available

POST /v1/wordpress/{id}/plugins/update-all · scope wordpress:write · reversible · idempotent

curl https://api.truo.cloud/v1/wordpress/svc_10432/plugins/update-all \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress plugin update-all svc_10432

await truo.wordpress.plugins.update_all("svc_10432");

truo_wordpress({
  "action": "plugin_update_all",
  "id": "svc_10432"
})

operationId: wordpress.plugins.update_all

Apply a recipe to a site

POST /v1/wordpress/{id}/recipes/apply · scope wordpress:write · reversible · asynchronous · idempotent

Runs the manifest against the site over WP-CLI, in order: requirements → zip checksums → backup → plugins → constants → options → roles → secrets → verify → register. requires is checked in this request (recipe_requirements_unmet, 412, nothing touched); everything else runs in the background and the operation result shows each step. A checksum mismatch fails before the backup with recipe_checksum_mismatch; a red verify fails with recipe_verify_failed and leaves the site as it is — the backup is the way back. On success the site stores truo_recipe = {name, version, applied_at} and, if the recipe declares secrets, result.secrets.claim says where to fetch them once.

curl https://api.truo.cloud/v1/wordpress/svc_10432/recipes/apply \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"haztap-golden"}'

truo wordpress recipes apply svc_10432

await truo.wordpress.recipes.apply("svc_10432", {"name":"haztap-golden"});

truo_wordpress({
  "action": "recipes_apply",
  "id": "svc_10432"
})

operationId: wordpress.recipes.apply

Register a recipe

POST /v1/wordpress/recipes · scope wordpress:write · reversible · idempotent

The body is a recipe/v1 manifest. It is validated in full before it is stored — limits, allowed constants, and every WP-CLI line it would run — and a problem comes back as recipe_invalid with param pointing at the field. Zips in url are not downloaded here; their checksum is verified when the recipe is applied. Max 20 recipes per account.

curl https://api.truo.cloud/v1/wordpress/recipes \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'

truo wordpress recipes create

await truo.wordpress.recipes.create({});

truo_wordpress({
  "action": "recipes_create"
})

operationId: wordpress.recipes.create

Delete a recipe and all its versions

DELETE /v1/wordpress/recipes/{name} · scope wordpress:write · destructive — cannot be undone · idempotent

Sites that already have it applied are not touched.

curl https://api.truo.cloud/v1/wordpress/recipes/haztap-golden \
  -X DELETE \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress recipes delete haztap-golden

await truo.wordpress.recipes.delete("haztap-golden");

truo_wordpress({
  "action": "recipes_delete",
  "name": "haztap-golden"
})

operationId: wordpress.recipes.delete

Get a recipe and its manifest

GET /v1/wordpress/recipes/{name} · scope wordpress:read

curl https://api.truo.cloud/v1/wordpress/recipes/haztap-golden \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress recipes get haztap-golden

await truo.wordpress.recipes.get("haztap-golden");

truo_wordpress({
  "action": "recipes_get",
  "name": "haztap-golden"
})

operationId: wordpress.recipes.get

List the recipes of this account

GET /v1/wordpress/recipes · scope wordpress:read

Recipes belong to the account, not to a site. Manifests are not included; use wordpress.recipes.get.

curl https://api.truo.cloud/v1/wordpress/recipes \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress recipes list

await truo.wordpress.recipes.list();

truo_wordpress({
  "action": "recipes_list"
})

operationId: wordpress.recipes.list

Claim the secrets a recipe generated (once)

POST /v1/wordpress/{id}/recipes/secrets · scope wordpress:write

Returns the values of the secrets a wordpress.recipes.apply operation generated for this site, exactly once: this response deletes them. They are kept encrypted for 24 hours after the operation succeeds; after that, or after a first claim, this is not_found. Store them on your side.

curl https://api.truo.cloud/v1/wordpress/svc_10432/recipes/secrets \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"operation":"op_01JQ8XKM4N7P2R9TAB12CD34EF"}'

truo wordpress recipes claim-secrets svc_10432

await truo.wordpress.recipes.secrets.claim("svc_10432", {"operation":"op_01JQ8XKM4N7P2R9TAB12CD34EF"});

truo_wordpress({
  "action": "recipes_claim_secrets",
  "id": "svc_10432"
})

operationId: wordpress.recipes.secrets.claim

Publish a new version of a recipe

PUT /v1/wordpress/recipes/{name} · scope wordpress:write · reversible · idempotent

The body is a full manifest whose name matches the URL and whose version is greater than every version already published. Published versions are immutable: a site that reports truo_recipe = name@1.2.0 always points at the manifest that was applied.

curl https://api.truo.cloud/v1/wordpress/recipes/haztap-golden \
  -X PUT \
  -H "Authorization: Bearer $TRUO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'

truo wordpress recipes update haztap-golden

await truo.wordpress.recipes.update("haztap-golden", {});

truo_wordpress({
  "action": "recipes_update",
  "name": "haztap-golden"
})

operationId: wordpress.recipes.update

Restart the site

POST /v1/wordpress/{id}/restart · scope wordpress:write · reversible · idempotent

Restarts the whole site (web server, PHP, database, cache): ~30 s of downtime. To reload PHP alone without downtime use POST /v1/wordpress/{id}/php/restart.

curl https://api.truo.cloud/v1/wordpress/svc_10432/restart \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress restart svc_10432

await truo.wordpress.restart("svc_10432");

truo_wordpress({
  "action": "restart",
  "id": "svc_10432"
})

operationId: wordpress.restart

Lift a lockout

DELETE /v1/wordpress/{id}/security/blocked-ips/{ip_id} · scope wordpress:write · reversible · idempotent

curl https://api.truo.cloud/v1/wordpress/svc_1241/security/blocked-ips/<ip_id> \
  -X DELETE \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress security unblock svc_1241 <ip_id>

await truo.wordpress.security.blocked_ips.delete("svc_1241", "<ip_id>");

truo_wordpress({
  "action": "security_unblock",
  "id": "svc_1241",
  "ipId": "<ip_id>"
})

operationId: wordpress.security.blocked_ips.delete

List IPs locked out for failed logins

GET /v1/wordpress/{id}/security/blocked-ips · scope wordpress:read

curl https://api.truo.cloud/v1/wordpress/svc_10432/security/blocked-ips \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress security blocked-ips svc_10432

await truo.wordpress.security.blocked_ips.list("svc_10432");

truo_wordpress({
  "action": "security_blocked_ips",
  "id": "svc_10432"
})

operationId: wordpress.security.blocked_ips.list

Get the security status

GET /v1/wordpress/{id}/security · scope wordpress:read

Login protection counters and the result of the last integrity scan (core and wordpress.org plugins against official checksums).

curl https://api.truo.cloud/v1/wordpress/svc_10432/security \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress security get svc_10432

await truo.wordpress.security.get("svc_10432");

truo_wordpress({
  "action": "security_get",
  "id": "svc_10432"
})

operationId: wordpress.security.get

Run an integrity scan now

POST /v1/wordpress/{id}/security/scan · scope wordpress:write · asynchronous · idempotent

Verifies core and wordpress.org plugins against their official checksums. The findings come in the operation result.

curl https://api.truo.cloud/v1/wordpress/svc_10432/security/scan \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress security scan svc_10432

await truo.wordpress.security.scan("svc_10432");

truo_wordpress({
  "action": "security_scan",
  "id": "svc_10432"
})

operationId: wordpress.security.scan

Create a staging environment

POST /v1/wordpress/{id}/staging · scope wordpress:write · reversible · asynchronous · idempotent

A full copy of the site (database and files) on its own URL, with fixed resources. Takes a minute or two. The operation carries the clone in result.

curl https://api.truo.cloud/v1/wordpress/svc_10432/staging \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress staging create svc_10432

await truo.wordpress.staging.create("svc_10432");

truo_wordpress({
  "action": "staging_create",
  "id": "svc_10432"
})

operationId: wordpress.staging.create

Delete a staging environment

DELETE /v1/wordpress/{id}/staging/{name} · scope wordpress:write · destructive — cannot be undone · idempotent

Irreversible: the clone and its data are removed. Production is not touched.

curl https://api.truo.cloud/v1/wordpress/svc_1241/staging/staging \
  -X DELETE \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress staging delete svc_1241 staging

await truo.wordpress.staging.delete("svc_1241", "staging");

truo_wordpress({
  "action": "staging_delete",
  "id": "svc_1241",
  "name": "staging"
})

operationId: wordpress.staging.delete

List staging environments

GET /v1/wordpress/{id}/staging · scope wordpress:read

curl https://api.truo.cloud/v1/wordpress/svc_10432/staging \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress staging list svc_10432

await truo.wordpress.staging.list("svc_10432");

truo_wordpress({
  "action": "staging_list",
  "id": "svc_10432"
})

operationId: wordpress.staging.list

Push a staging environment to production

POST /v1/wordpress/{id}/staging/{name}/push · scope wordpress:write · destructive — cannot be undone · asynchronous · idempotent

Destructive: copies the database and/or the files of the clone OVER the live site. Take a backup of production first.

curl https://api.truo.cloud/v1/wordpress/svc_1241/staging/staging/push \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress staging push svc_1241 staging

await truo.wordpress.staging.push("svc_1241", "staging");

truo_wordpress({
  "action": "staging_push",
  "id": "svc_1241",
  "name": "staging"
})

operationId: wordpress.staging.push

Get runtime state, health and resource usage

GET /v1/wordpress/{id}/status · scope wordpress:read

Health (installed, database reachable, pending updates) comes from a check the node runs every 15 minutes: checked_at says when. Resource usage is measured for this request.

curl https://api.truo.cloud/v1/wordpress/svc_10432/status \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress status svc_10432

await truo.wordpress.status("svc_10432");

truo_wordpress({
  "action": "status",
  "id": "svc_10432"
})

operationId: wordpress.status

Activate a theme

POST /v1/wordpress/{id}/themes/{slug}/activate · scope wordpress:write · reversible · idempotent

curl https://api.truo.cloud/v1/wordpress/svc_1241/themes/woocommerce/activate \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress theme activate svc_1241 woocommerce

await truo.wordpress.themes.activate("svc_1241", "woocommerce");

truo_wordpress({
  "action": "theme_activate",
  "id": "svc_1241",
  "slug": "woocommerce"
})

operationId: wordpress.themes.activate

Delete a theme

DELETE /v1/wordpress/{id}/themes/{slug} · scope wordpress:write · destructive — cannot be undone · idempotent

The active theme cannot be deleted: activate another one first.

curl https://api.truo.cloud/v1/wordpress/svc_1241/themes/woocommerce \
  -X DELETE \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress theme delete svc_1241 woocommerce

await truo.wordpress.themes.delete("svc_1241", "woocommerce");

truo_wordpress({
  "action": "theme_delete",
  "id": "svc_1241",
  "slug": "woocommerce"
})

operationId: wordpress.themes.delete

Install a theme

POST /v1/wordpress/{id}/themes · scope wordpress:write · reversible · idempotent

From wordpress.org by slug, or from an https:// zip. Does not activate it unless activate is true.

curl https://api.truo.cloud/v1/wordpress/svc_10432/themes \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"slug":"woocommerce"}'

truo wordpress theme install svc_10432

await truo.wordpress.themes.install("svc_10432", {"slug":"woocommerce"});

truo_wordpress({
  "action": "theme_install",
  "id": "svc_10432"
})

operationId: wordpress.themes.install

List installed themes

GET /v1/wordpress/{id}/themes · scope wordpress:read

curl https://api.truo.cloud/v1/wordpress/svc_10432/themes \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress theme list svc_10432

await truo.wordpress.themes.list("svc_10432");

truo_wordpress({
  "action": "theme_list",
  "id": "svc_10432"
})

operationId: wordpress.themes.list

Search wordpress.org for themes

GET /v1/wordpress/{id}/themes/search · scope wordpress:read

curl https://api.truo.cloud/v1/wordpress/svc_10432/themes/search \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress theme search svc_10432

await truo.wordpress.themes.search("svc_10432");

truo_wordpress({
  "action": "theme_search",
  "id": "svc_10432"
})

operationId: wordpress.themes.search

Update a theme

POST /v1/wordpress/{id}/themes/{slug}/update · scope wordpress:write · reversible · idempotent

curl https://api.truo.cloud/v1/wordpress/svc_1241/themes/woocommerce/update \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress theme update svc_1241 woocommerce

await truo.wordpress.themes.update("svc_1241", "woocommerce");

truo_wordpress({
  "action": "theme_update",
  "id": "svc_1241",
  "slug": "woocommerce"
})

operationId: wordpress.themes.update

Update every theme with an update available

POST /v1/wordpress/{id}/themes/update-all · scope wordpress:write · reversible · idempotent

curl https://api.truo.cloud/v1/wordpress/svc_10432/themes/update-all \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN"

truo wordpress theme update-all svc_10432

await truo.wordpress.themes.update_all("svc_10432");

truo_wordpress({
  "action": "theme_update_all",
  "id": "svc_10432"
})

operationId: wordpress.themes.update_all

Run a WP-CLI command

POST /v1/wordpress/{id}/wp-cli · scope wordpress:console · destructive — cannot be undone · idempotent

Runs wp <command> <args…> inside the site and returns exit_code, output and error in the operation result (output capped at 64 KB, truncated: true past it). A non-zero exit code is the command’s result, not an API error. Only an allowlist of subcommands runs: no eval, no shell, no free-form db query, no global flags that change where it runs. Requires wordpress:console: WP-CLI is full access to the site and its database.

curl https://api.truo.cloud/v1/wordpress/svc_10432/wp-cli \
  -X POST \
  -H "Authorization: Bearer $TRUO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"command":"plugin list"}'

truo wordpress wp-cli svc_10432

await truo.wordpress.wpcli.run("svc_10432", {"command":"plugin list"});

truo_wordpress({
  "action": "wp_cli",
  "id": "svc_10432"
})

operationId: wordpress.wpcli.run