openapi: 3.2.0
info:
  title: WordPress.com REST API v1.1 Protect API
  version: v1.1
  description: 'The WordPress.com REST API, operated by Automattic. Derived by API Evangelist from Automattic''s own self-describing help document at https://public-api.wordpress.com/rest/v1.1/help (Accept: application/json), which publishes every endpoint''s method, path, description, path/query/body parameters and response fields. Security schemes come from https://public-api.wordpress.com/.well-known/openid-configuration. The error envelope was observed live.'
  termsOfService: https://wordpress.com/tos/
  contact:
    name: WordPress.com Developer Resources
    url: https://developer.wordpress.com/docs/api/
  x-derived-from: https://public-api.wordpress.com/rest/v1.1/help
  x-derived-by: API Evangelist enrichment pipeline
servers:
- url: https://public-api.wordpress.com/rest/v1.1
security:
- bearerAuth: []
tags:
- name: protect
paths:
  /sites/{site}/protect/recovery/confirm:
    post:
      operationId: postSitesBySiteProtectRecoveryConfirm
      summary: A site confirms that a user can bypass jetpack to try to login and login
      description: A site confirms that a user can bypass jetpack to try to login and login
      tags:
      - protect
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Authorization required
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      parameters:
      - name: site
        in: path
        required: true
        schema:
          type: string
        description: The site's id or domain
      - name: context
        in: query
        required: false
        schema:
          type: string
          enum:
          - display
          - edit
        description: 'display: (default) Formats the output as HTML for display.  Shortcodes are parsed, paragraph tags are added, etc..; edit: Formats the output for editing.  Shortcodes are left unparsed, significant whitespace is kept, etc..'
      - name: http_envelope
        in: query
        required: false
        schema:
          type: boolean
        description: 'false: (default); true: Some environments (like in-browser JavaScript or Flash) block or divert responses with a non-200 HTTP status code.  Setting this parameter will force the HTTP status code to always be 200.  The JSON response is wrapped in an "envelope" containing the "real" HTTP status code and headers.'
      - name: pretty
        in: query
        required: false
        schema:
          type: boolean
        description: 'false: (default); true: Output pretty JSON'
      - name: meta
        in: query
        required: false
        schema:
          type: string
        description: 'Optional. Loads data from the endpoints found in the ''meta'' part of the response. Comma-separated list. Example: meta=site,likes'
      - name: fields
        in: query
        required: false
        schema:
          type: string
        description: 'Optional. Returns specified fields only. Comma-separated list. Example: fields=ID,title'
      - name: callback
        in: query
        required: false
        schema:
          type: string
        description: An optional JSONP callback function.
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              properties:
                user_id:
                  type: integer
                  description: The id of the user requesting a recovery email.
                ip:
                  type: string
                  description: The IP of the user requesting a recovery email.
                token:
                  type: string
                  description: The recovery token.
  /sites/{site}/protect/recovery/request:
    post:
      operationId: postSitesBySiteProtectRecoveryRequest
      summary: A user request an email containing a recovery url that they can use to bypass a Protect blockage
      description: A user request an email containing a recovery url that they can use to bypass a Protect blockage
      tags:
      - protect
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Authorization required
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      parameters:
      - name: site
        in: path
        required: true
        schema:
          type: string
        description: The site's id or domain
      - name: context
        in: query
        required: false
        schema:
          type: string
          enum:
          - display
          - edit
        description: 'display: (default) Formats the output as HTML for display.  Shortcodes are parsed, paragraph tags are added, etc..; edit: Formats the output for editing.  Shortcodes are left unparsed, significant whitespace is kept, etc..'
      - name: http_envelope
        in: query
        required: false
        schema:
          type: boolean
        description: 'false: (default); true: Some environments (like in-browser JavaScript or Flash) block or divert responses with a non-200 HTTP status code.  Setting this parameter will force the HTTP status code to always be 200.  The JSON response is wrapped in an "envelope" containing the "real" HTTP status code and headers.'
      - name: pretty
        in: query
        required: false
        schema:
          type: boolean
        description: 'false: (default); true: Output pretty JSON'
      - name: meta
        in: query
        required: false
        schema:
          type: string
        description: 'Optional. Loads data from the endpoints found in the ''meta'' part of the response. Comma-separated list. Example: meta=site,likes'
      - name: fields
        in: query
        required: false
        schema:
          type: string
        description: 'Optional. Returns specified fields only. Comma-separated list. Example: fields=ID,title'
      - name: callback
        in: query
        required: false
        schema:
          type: string
        description: An optional JSONP callback function.
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              properties:
                user_id:
                  type: integer
                  description: The id of the user requesting a recovery email.
                ip:
                  type: string
                  description: The IP of the user requesting a recovery email.
  /sites/{site}/protect/recovery/validate/{user_id}:
    get:
      operationId: getSitesBySiteProtectRecoveryValidateByUserId
      summary: Validates a url emailed to a user containing a recovery toke that they can use to bypass a Protect blockage
      description: Validates a url emailed to a user containing a recovery toke that they can use to bypass a Protect blockage
      tags:
      - protect
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Authorization required
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      parameters:
      - name: site
        in: path
        required: true
        schema:
          type: string
        description: The site's id or domain
      - name: user_id
        in: path
        required: true
        schema:
          type: string
        description: The user id
      - name: context
        in: query
        required: false
        schema:
          type: string
          enum:
          - display
          - edit
        description: 'display: (default) Formats the output as HTML for display.  Shortcodes are parsed, paragraph tags are added, etc..; edit: Formats the output for editing.  Shortcodes are left unparsed, significant whitespace is kept, etc..'
      - name: http_envelope
        in: query
        required: false
        schema:
          type: boolean
        description: 'false: (default); true: Some environments (like in-browser JavaScript or Flash) block or divert responses with a non-200 HTTP status code.  Setting this parameter will force the HTTP status code to always be 200.  The JSON response is wrapped in an "envelope" containing the "real" HTTP status code and headers.'
      - name: pretty
        in: query
        required: false
        schema:
          type: boolean
        description: 'false: (default); true: Output pretty JSON'
      - name: meta
        in: query
        required: false
        schema:
          type: string
        description: 'Optional. Loads data from the endpoints found in the ''meta'' part of the response. Comma-separated list. Example: meta=site,likes'
      - name: fields
        in: query
        required: false
        schema:
          type: string
        description: 'Optional. Returns specified fields only. Comma-separated list. Example: fields=ID,title'
      - name: callback
        in: query
        required: false
        schema:
          type: string
        description: An optional JSONP callback function.
      - name: token
        in: query
        required: false
        schema:
          type: string
        description: The recovery token.
      - name: action
        in: query
        required: false
        schema:
          type: string
        description: What action to redirect the to.
components:
  schemas:
    Error:
      type: object
      description: WordPress.com REST API error envelope (observed live).
      properties:
        error:
          type: string
          examples:
          - not_found
        message:
          type: string
  securitySchemes:
    oauth2:
      type: oauth2
      description: WordPress.com OAuth 2.1 (see /.well-known/openid-configuration).
      flows:
        authorizationCode:
          authorizationUrl: https://public-api.wordpress.com/oauth2-1/authorize
          tokenUrl: https://public-api.wordpress.com/oauth2-1/token
          refreshUrl: https://public-api.wordpress.com/oauth2-1/token
          scopes:
            global: ''
            auth: ''
            openid: ''
            profile: ''
            email: ''
            users: ''
            sites: ''
            posts: ''
            comments: ''
            taxonomy: ''
            follow: ''
            sharing: ''
            freshly-pressed: ''
            notifications: ''
            insights: ''
            read: ''
            stats: ''
            media: ''
            menus: ''
            batch: ''
            videos: ''
    bearerAuth:
      type: http
      scheme: bearer
      description: 'Authorization: Bearer <access_token>'