generated: '2026-08-04' method: derived source: >- live response headers and behaviour observed on https://cresilon.com/wp-json/ (2026-08-04), plus this repo's openapi/ specs summary: >- Cross-cutting request/response semantics of the Cresilon content API. Everything here was observed on the wire; where a convention is absent (idempotency keys, request-id tracing, rate-limit signalling, caching validators) it is recorded as absent rather than assumed present. This is the stock WordPress core REST contract as deployed on cresilon.com via WordPress.com Atomic hosting — Cresilon has not layered any conventions of its own on top of it. authentication: style: none-for-read detail: >- The documented read surface takes no credential at all. The root index advertises Application Passwords, an administrative credential, not a developer one. See authentication/cresilon-authentication.yml. artifact: authentication/cresilon-authentication.yml pagination: style: page-number supported: true request: page: in: query default: 1 description: 1-indexed page number. per_page: in: query default: 10 min: 1 max: 100 description: >- Page size. Verified live — a value of 999 returns HTTP 400 rest_invalid_param with the message "per_page must be between 1 (inclusive) and 100 (inclusive)". offset: in: query description: Alternative cursorless skip, accepted alongside page/per_page. response: body: A bare JSON array of objects; there is no envelope and no cursor. headers: X-WP-Total: Total number of items in the collection. Observed as 36 on /wp/v2/posts. X-WP-TotalPages: Total page count at the current per_page. Observed as 18 at per_page=2. Link: >- RFC 8288 Link header carrying rel="next" and rel="prev". Observed: ; rel="next" cors: >- Access-Control-Expose-Headers advertises X-WP-Total, X-WP-TotalPages and Link, so a browser client can read the pagination signals cross-origin. filtering: supported: true detail: >- Collections accept search, slug[], include[], exclude[], offset, after/before (ISO 8601), order (asc|desc) and orderby. Post collections additionally accept categories[], categories_exclude[], tags[], tags_exclude[] and sticky. Page collections accept parent[] and menu_order. Media collections accept media_type, mime_type and parent[]. Term collections accept hide_empty and post. field_shaping: context: supported: true values: [view, embed] detail: >- The `context` parameter selects the field set. Only `view` (default) and `embed` are available anonymously; `edit` requires authentication. sparse_fields: supported: true param: _fields detail: >- WordPress core supports a `_fields` comma-separated allow-list to trim the response. Verified live with `_fields=id,slug,link,title`. Materially useful against this surface because post and page objects carry a large `yoast_head` string and a full `yoast_head_json` graph by default — a single un-trimmed page object measured 51 KB. embedding: supported: true param: _embed detail: >- `_embed=true` inlines the linked resources named in `_links` (author, wp:term, wp:featuredmedia) under an `_embedded` key, collapsing the id-reference round trips described in data-model/cresilon-data-model.yml. hypermedia: style: HAL-like detail: >- Every object carries a `_links` object with self, collection, about, author, wp:term, wp:attachment, replies, version-history and predecessor-version relations, plus a `curies` entry defining the wp: prefix. Search results additionally carry `targetHints.allow: ["GET"]` on the self relation, which is the surface's only explicit statement that a resource is read-only to the caller. This is the site's only in-band navigation affordance. idempotency: supported: false detail: >- No Idempotency-Key header, parameter or documented retry contract exists anywhere on this surface. The documented operations are all GET and therefore idempotent by HTTP method, but the provider publishes no idempotency contract for unsafe operations. No `Idempotency` pointer is wired in apis.yml for this provider — there is no idempotency contract to point at. request_tracing: supported: false detail: >- No request-id or correlation-id header is returned and no trace context is echoed. The responses do carry hosting-layer diagnostics (`x-ac`, `server-timing: a8c-cdn, dc;desc=jfk, cache;desc=MISS`) which identify the WordPress.com Atomic edge and cache result, but these are operator telemetry, not a caller-usable correlation id. rate_limiting: supported: false detail: >- No X-RateLimit-*, RateLimit-* (RFC 9331 style) or Retry-After headers were observed on any response. /robots.txt sets no Crawl-delay. Callers should self-throttle; the provider gives no signal. caching: supported: false detail: >- No Cache-Control, ETag, Last-Modified or Age header was observed on any REST response, so neither a freshness window nor conditional requests are available. Responses do report the edge cache outcome via `server-timing: cache;desc=MISS`, which is informational only. indexing: >- Responses carry `X-Robots-Tag: noindex` — the API output is deliberately excluded from search engines even though it is publicly readable. versioning: scheme: uri-path-namespace detail: >- Version lives in the namespace segment of the path (`/wp-json/wp/v2/...`, `/wp-json/oembed/1.0/...`, `/wp-json/yoast/v1/...`). It is set by the WordPress platform and its plugins, not by Cresilon. See lifecycle/cresilon-lifecycle.yml. error_envelope: format: wordpress-rest-error rfc9457: false detail: See errors/cresilon-problem-types.yml for the shape and the observed code registry. artifact: errors/cresilon-problem-types.yml content_negotiation: media_type: application/json; charset=UTF-8 detail: >- JSON only on the wp/v2 and yoast/v1 namespaces. The oEmbed endpoint additionally accepts `format=xml` (verified live). There is no CSV, XML or protobuf representation of the content routes. An RSS 2.0 feed of the same posts is published outside the API at https://cresilon.com/feed/. cookies: detail: >- Every REST response sets a `__wpdm_client` session cookie (WordPress Download Manager, the plugin behind the member area and the gated TRAUMAGEL/VETIGEL resource downloads). It is marked Secure and HttpOnly and is not required for any documented read operation — anonymous clients can and should discard it. security_headers: strict_transport_security: max-age=31536000 x_content_type_options: nosniff detail: >- HSTS IS present on cresilon.com at one year, without includeSubDomains or preload. See security/cresilon-domain-security.yml. cross_links: authentication: authentication/cresilon-authentication.yml errors: errors/cresilon-problem-types.yml lifecycle: lifecycle/cresilon-lifecycle.yml data_model: data-model/cresilon-data-model.yml conformance: conformance/cresilon-conformance.yml x-evidence: fetched: '2026-08-04' host: https://cresilon.com headers_observed: - 'x-wp-total: 36' - 'x-wp-totalpages: 18' - 'link: ; rel="next"' - 'strict-transport-security: max-age=31536000' - 'x-robots-tag: noindex' - 'x-content-type-options: nosniff' - 'access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link' - 'access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type' - 'allow: GET' - 'set-cookie: __wpdm_client=...; secure; HttpOnly' - 'server: nginx' - 'host-header: WordPress.com' headers_absent: - Cache-Control - ETag - Last-Modified - Retry-After - X-RateLimit-Limit - X-Request-Id - Idempotency-Key