generated: '2026-08-01'
method: derived
source:
- openapi/circle-pharma-content-openapi.yml
- https://circlepharma.com/wp-json/
- live response headers observed 2026-08-01 on GET /wp-json/wp/v2/posts
note: >-
  Cross-cutting semantics for the Circle Pharma Content API. Circle Pharma publishes no developer
  documentation of its own; these conventions are those of the WordPress REST API (wp/v2) as
  implemented on circlepharma.com, derived from the site's published route index and verified against
  live responses. Nothing here is a Circle Pharma product commitment.
authentication:
  style: none-for-read
  detail: >-
    Every operation modelled in openapi/ returns 200 anonymously. Write and administrative routes on
    the same namespace require WordPress Application Passwords (HTTP Basic over TLS) or a logged-in
    cookie plus an X-WP-Nonce header; /wp/v2/users and /wp/v2/settings return 401
    (rest_user_cannot_view / rest_forbidden) without credentials.
  ref: authentication/circle-pharma-authentication.yml
idempotency:
  supported: false
  detail: >-
    No idempotency key is accepted or documented. Not applicable in practice for this surface — the
    public contract is read-only (GET), which is idempotent by HTTP method semantics, and there is no
    unsafe public operation that would need a replay key.
pagination:
  style: page-number
  params:
  - name: page
    default: 1
    description: 1-indexed page of the collection.
  - name: per_page
    default: 10
    maximum: 100
  - name: offset
    description: Offset the result set by a specific number of items.
  response_headers:
  - name: X-WP-Total
    description: Total number of records matching the query.
  - name: X-WP-TotalPages
    description: Total number of pages available.
  - name: Link
    description: RFC 8288 link header carrying rel="next" and rel="prev".
  cors_exposed: [X-WP-Total, X-WP-TotalPages, Link]
  example: GET /wp-json/wp/v2/posts?per_page=2 -> x-wp-total 107, x-wp-totalpages 54
filtering_and_sorting:
  search: '`search` free-text parameter on every collection'
  ordering: '`order` (asc|desc) + `orderby` (date, id, title, slug, relevance, include, modified)'
  date_windows: [after, before, modified_after, modified_before]
  taxonomy_filters:
  - categories / categories_exclude (posts)
  - tags / tags_exclude (posts)
  - member_type / member_type_exclude (team)
  - event_type / event_type_exclude (all_events)
  identity_filters: [include, exclude, slug, status]
field_selection:
  sparse_fieldsets:
    param: _fields
    detail: Comma-separated list of top-level fields to return, e.g. `_fields=id,title,link,date`.
  embedding:
    param: _embed
    detail: >-
      Inlines linked resources (featured media, taxonomy terms, author) under `_embedded`, resolving
      the HAL-style `_links` in one round trip.
  context:
    param: context
    values: [view, embed, edit]
    default: view
    detail: '`edit` requires authentication; anonymous callers get `view` or `embed` shapes.'
  rendered_fields: >-
    title, content and excerpt are objects with a `rendered` string (and `protected` boolean), not
    plain strings — a common integration trap.
metadata:
  link_relations: >-
    Every record carries a `_links` object (HAL-style, with a `curies` block pointing at
    https://api.w.org/{rel}) linking self, collection, about, author, replies, wp:featuredmedia,
    wp:term.
request_tracing:
  request_id_header: none
  detail: >-
    No provider request-id is returned. Cloudflare's `cf-ray` and WP Engine's `x-cache` /
    `x-cache-group` headers are the only correlatable identifiers observed.
versioning:
  style: namespace-in-path
  current: wp/v2
  detail: >-
    Version is a namespace segment (`/wp-json/wp/v2/...`). The namespace list is published at
    /wp-json/ under `namespaces`. There is no header or date-based versioning.
  ref: lifecycle/circle-pharma-lifecycle.yml
error_envelope:
  format: wordpress-rest
  rfc9457: false
  content_type: application/json
  shape:
    code: machine-readable error slug (e.g. rest_post_invalid_id)
    message: human-readable message
    data.status: HTTP status code, repeated in the body
  ref: errors/circle-pharma-problem-types.yml
rate_limiting:
  documented: false
  headers: none observed
  detail: >-
    No RateLimit headers (RFC 9331 or X-RateLimit-*) are returned. The origin sits behind Cloudflare
    and WP Engine caching (`cache-control: max-age=600, must-revalidate`, `x-cacheable: SHORT`), so
    edge caching, not a published quota, is the effective throttle. robots.txt advertises
    `Crawl-delay: 10` for crawlers.
caching:
  cache_control: 'max-age=600, must-revalidate'
  validators: Last-Modified present; no ETag observed
  conditional_requests: If-Modified-Since honoured by the edge
cors:
  allow_headers: [Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type]
  expose_headers: [X-WP-Total, X-WP-TotalPages, Link]
content_negotiation:
  media_type: application/json; charset=UTF-8
  method_override: '`_method` query parameter / X-HTTP-Method-Override supported by WordPress'