REST API Overview

Last updated on November 9, 2026

Quick Start

The simplest API call is checking a license status. Here is how to do it with curl:

curl -X POST https://your-site.com/wp-json/slswc/v1/check_license \
  -d license_key=ABCD-1234-EFGH-5678 \
  -d domain=https://customer-site.com

Breaking this down:

POST — License endpoints use POST requests.
/wp-json/slswc/v1/ — The base URL for all SLSWC API endpoints.
check_license — The action to perform. Other actions include activate, deactivate, and check_update.
license_key — The customer's license key. This is the only authentication needed for client-facing endpoints.
domain — The site making the request. The server uses this to track activations.

The response tells you whether the license is valid:

{
    "status": "active",
    "product_name": "My Plugin",
    "message": "The license is valid",
    "expires": "2027-01-15 00:00:00",
    "domain": {
        "domain": "https://customer-site.com",
        "status": "active"
    }
}

For the full list of license endpoints, see License Endpoints.

Tip: If you are building a WordPress plugin or theme, you do not need to call the API directly. Use the Client Library instead — it handles all API communication, update checks, and license management for you.

Base URL

https://your-site.com/wp-json/slswc/v1/

The namespace slswc/v1 is filterable:

add_filter( 'slswc_api_namespace', function () {
    return 'my-custom/v1';
} );

Authentication

SLSWC supports three authentication mechanisms depending on the endpoint type.

1. License Key (Client Endpoints)

Public-facing license endpoints (/activate, /deactivate, /check_license, /check_update, /add_domain, /remove_domain) authenticate by validating the license_key parameter. No user session is required. The server verifies that the license key exists and is valid.

curl -X POST https://your-site.com/wp-json/slswc/v1/activate \
  -d license_key=ABCD-1234-EFGH-5678 \
  -d domain=https://customer-site.com \
  -d environment=live

Admin endpoints (/licenses, /subscriptions, /settings, /dashboard/*, /reports/*) and customer-facing My Account endpoints (/my-licenses, /my-subscriptions, /my-api-key) require a logged-in WordPress user session.

The permission check varies by endpoint:

Permission	Required capability	Used by
`manage_options`	WordPress administrator	Settings, dashboard, reports, migrations
`is_user_logged_in`	Any authenticated user	My Account, support tickets
Public	None	Product listing, license recovery, support categories

When calling from JavaScript, include the WordPress nonce:

fetch('/wp-json/slswc/v1/my-licenses', {
    headers: {
        'X-WP-Nonce': wpApiSettings.nonce
    }
});

3. API Keys (Connect Endpoint)

The /connect endpoint uses WooCommerce-style API key authentication:

curl -X POST https://your-site.com/wp-json/slswc/v1/connect \
  -d username=john \
  -d consumer_key=ck_xxxx \
  -d consumer_secret=cs_xxxx

The server validates the username, consumer_key, and consumer_secret against the woocommerce_api_keys table.

4. HTTP Basic Auth (Composer Repository)

The Composer repository endpoint (/slswc-composer/packages.json) uses HTTP Basic Authentication with the license key as both username and password:

curl -u LICENSE_KEY:LICENSE_KEY https://your-site.com/slswc-composer/packages.json

Standard Response Format

Success

{
    "status": "ok",
    "message": "Description of what happened",
    "data": { }
}

License endpoints return a status field that indicates the license state (active, inactive, expired, deactivated, invalid, etc.).

Error

{
    "code": "error_code",
    "message": "Human-readable error message",
    "data": {
        "status": 400
    }
}

Common Status Codes

Code	Meaning
`200`	Success
`301`	Authentication failed (connect endpoint)
`400`	Bad request / missing parameters
`401`	Unauthorized
`403`	Forbidden / insufficient permissions
`404`	Resource not found
`429`	Rate limited (license recovery)
`500`	Server error
`503`	Service unavailable

Caching

Many license-related responses are cached using WordPress transients. Cache expiry times are filterable:

Filter	Default	Used by
`slswc_check_license_cache_expiry`	12 hours	`check_license`
`slswc_check_for_update_cache_expiry`	12 hours	`check_update`
`slswc_activate_license_cache_expiry`	12 hours	`activate`
`slswc_get_product_details_cache_expiry`	12 hours	`product`
`slswc_license_stats_cache_expiry`	1 hour	`stats`
`slswc_customer_licenses_cache_expiry`	12 hours	`licenses`

Caching can be disabled globally through the plugin settings.

Pagination

List endpoints support pagination via query parameters:

Parameter	Type	Default	Description
`page`	int	1	Page number
`per_page`	int	10-20	Items per page
`search`	string	`""`	Search term
`status`	string	`""`	Filter by status

Endpoint Reference

License Endpoints — Activate, deactivate, check, and manage licenses
Subscription Endpoints — Admin subscription management
Support Endpoints — Ticket system
My Account Endpoints — Customer self-service
Admin Endpoints — Dashboard, reports, settings, migrations