# Automattic

> Automattic is the company behind WordPress.com, Jetpack, WooCommerce, Tumblr, Gravatar, Akismet,
> WordPress VIP, Pocket Casts, Day One, Beeper and Simplenote. Its developer platform is the
> WordPress.com REST API on `public-api.wordpress.com`, which serves three parallel namespaces
> (`/rest/v1.x`, `/wp/v2`, `/wpcom/v2`) behind one OAuth 2.1 / OpenID Connect authorization
> server, plus a hosted Model Context Protocol server, the Akismet spam-classification API, and a
> GraphQL Platform API for the enterprise WordPress VIP product.

This file was generated by the API Evangelist enrichment pipeline from Automattic's own published
surfaces. Automattic publishes no llms.txt on its main developer host; WordPress VIP does, and it
is mirrored in this repo as `automattic-wpvip-llms.txt`.

## APIs

- [WordPress.com REST API v1.1](https://developer.wordpress.com/docs/api/): 253 endpoints across
  sites, posts, comments, media, taxonomy, stats, Reader and account. Base
  `https://public-api.wordpress.com/rest/v1.1`.
- [WordPress.com REST API v1.2](https://developer.wordpress.com/docs/api/): 38 additive alternate
  endpoints.
- [WordPress.com REST API v1.3](https://developer.wordpress.com/docs/api/): 19 additive alternate
  endpoints, including marketplace search.
- [WordPress.com REST API — wp/v2](https://public-api.wordpress.com/wp/v2/): WordPress-core-shaped
  namespace, site-scoped as `/wp/v2/sites/{site}/…`, 348 operations.
- [WordPress.com REST API — wpcom/v2](https://public-api.wordpress.com/wpcom/v2/): WordPress.com
  and Jetpack platform extensions — hosting, domains, plans, marketplace, AI — 1,716 operations.
- [WordPress.com MCP server](https://developer.wordpress.com/docs/mcp/): hosted MCP endpoint at
  `https://public-api.wordpress.com/wpcom/v2/mcp/v1`, OAuth 2.1 with PKCE and dynamic client
  registration, 12 documented tools. Paid plans only.
- [Akismet API](https://akismet.com/development/api/): spam classification. Base
  `https://rest.akismet.com`. 6 operations.
- [Jetpack AI-Plugin API](https://public-api.wordpress.com/wpcom/v2/ai-plugin/openapi.yaml): list
  and create posts across a user's Jetpack and WordPress.com sites. 4 operations.
- [WordPress VIP Platform API](https://docs.wpvip.com/vip-api/): GraphQL at
  `https://api.wpvip.com/graphql`. Introspection is authentication-gated.

## Specs

- openapi/automattic-wordpress-com-rest-v1-1-openapi.yml — derived from
  https://public-api.wordpress.com/rest/v1.1/help
- openapi/automattic-wordpress-com-rest-v1-2-openapi.yml
- openapi/automattic-wordpress-com-rest-v1-3-openapi.yml
- openapi/automattic-wordpress-com-wp-v2-openapi.yml — derived from the wp/v2 route index
- openapi/automattic-wordpress-com-wpcom-v2-openapi.yml — derived from the wpcom/v2 route index
- openapi/automattic-akismet-openapi.yml — published by Automattic at
  https://github.com/Automattic/akismet-api
- openapi/automattic-jetpack-ai-plugin-openapi.yaml — published by Automattic at
  https://public-api.wordpress.com/wpcom/v2/ai-plugin/openapi.yaml

## Discovery

- [OpenID Connect discovery](https://public-api.wordpress.com/.well-known/openid-configuration)
- [OAuth 2.0 authorization server metadata](https://public-api.wordpress.com/.well-known/oauth-authorization-server)
- [OAuth 2.0 protected resource metadata](https://public-api.wordpress.com/.well-known/oauth-protected-resource)
- [OpenAI plugin manifest (Jetpack)](https://public-api.wordpress.com/.well-known/ai-plugin.json)
- [security.txt](https://automattic.com/.well-known/security.txt)
- Self-describing help documents: `https://public-api.wordpress.com/rest/{v1|v1.1|v1.2|v1.3}/help`
  with `Accept: application/json`
- Route indexes: `https://public-api.wordpress.com/wp/v2/` and
  `https://public-api.wordpress.com/wpcom/v2/`

## Docs

- [Developer portal](https://developer.wordpress.com/)
- [REST API documentation](https://developer.wordpress.com/docs/api/)
- [Getting started](https://developer.wordpress.com/docs/api/getting-started/)
- [OAuth2 authentication](https://developer.wordpress.com/docs/api/oauth2/)
- [Developer console](https://developer.wordpress.com/docs/api/console/)
- [Using the REST API from JavaScript (CORS)](https://developer.wordpress.com/docs/api/rest-api-javascript/)
- [Guidelines for responsible use of Automattic's APIs](https://developer.wordpress.com/docs/api/guidelines-for-responsible-use-of-automattics-apis/)
- [MCP tools reference](https://developer.wordpress.com/docs/mcp/tools/)
- [WordPress VIP documentation](https://docs.wpvip.com/)
- [WordPress VIP llms.txt](https://docs.wpvip.com/llms.txt)

## Operations

- [Status page](https://automatticstatus.com/)
- [Studio changelog](https://developer.wordpress.com/changelog/)
- [VIP platform changelog](https://docs.wpvip.com/changelogs/)
- [Security](https://automattic.com/security/) — bug bounty at https://hackerone.com/automattic
- [WordPress VIP trust center](https://wpvip.com/trust/) — FedRAMP Moderate, SOC 2 Type I, GovRAMP,
  TX-RAMP
- [Terms of service](https://wordpress.com/tos/) · [Privacy](https://automattic.com/privacy/)

## Agent notes

- There is **no idempotency key** on any WordPress.com namespace. Retrying a POST can duplicate.
- Errors are **not** RFC 9457. `/rest/v1.x` returns `{error, message}`; `/wp/v2` and `/wpcom/v2`
  return `{code, message, data:{status}}`.
- Setting `http_envelope=true` forces HTTP 200 and moves the real status into the body — read the
  body, not the transport status, when that flag is set.
- No rate-limit headers and no published quota; the responsible-use policy is qualitative.
- `/rest/v1.x` list responses carry a `found` total; `/wp/v2` uses `X-WP-Total` and
  `X-WP-TotalPages` headers plus RFC 5988 `Link` rel="next".
- The `{site}` path segment accepts either a numeric site ID or a domain.
- No A2A agent card is published on any Automattic host.