generated: '2026-08-01' method: derived source: >- live response headers and behaviour observed on https://www.gothamgreens.com/wp-json/ (2026-08-01), plus this repo's openapi/ specs summary: >- Cross-cutting request/response semantics of the Gotham Greens content API. Everything here was observed on the wire; where a convention is absent (idempotency keys, request-id tracing, rate-limit signalling) it is recorded as absent rather than assumed present. This is the stock WordPress core REST contract as deployed on gothamgreens.com — Gotham Greens has not layered any conventions of its own on top of it. authentication: style: none-for-read detail: >- The documented read surface takes no credential at all. See authentication/gotham-greens-authentication.yml. artifact: authentication/gotham-greens-authentication.yml pagination: style: page-number supported: true request: page: in: query default: 1 description: 1-indexed page number. per_page: in: query default: 10 min: 1 max: 100 description: >- Page size. Verified live — a value of 999 returns HTTP 400 rest_invalid_param with the message "per_page must be between 1 (inclusive) and 100 (inclusive)". response: body: A bare JSON array of objects; there is no envelope and no cursor. headers: X-WP-Total: Total number of items in the collection. Observed as 132 on /wp/v2/posts. X-WP-TotalPages: Total page count at the current per_page. Observed as 66 at per_page=2. Link: >- RFC 8288 Link header carrying rel="next" and rel="prev". Observed: ; rel="next" cors: >- Access-Control-Expose-Headers advertises X-WP-Total, X-WP-TotalPages and Link, so a browser client can read the pagination signals cross-origin. filtering: supported: true detail: >- Collections accept search, slug[], include[], exclude[], after/before (ISO 8601), order (asc|desc) and orderby. Post collections additionally accept categories[], categories_exclude[], tags[] and sticky. Page collections accept parent[] and menu_order. Media collections accept media_type, mime_type and parent[]. field_shaping: context: supported: true values: [view, embed] detail: >- The `context` parameter selects the field set. Only `view` (default) and `embed` are available anonymously; `edit` requires authentication. sparse_fields: supported: true param: _fields detail: >- WordPress core supports a `_fields` comma-separated allow-list to trim the response. Useful against this surface because post objects carry a large yoast_head string by default. embedding: supported: true param: _embed detail: >- `_embed=true` inlines the linked resources named in `_links` (author, wp:term, wp:featuredmedia) under an `_embedded` key, collapsing the id-reference round trips described in data-model/gotham-greens-data-model.yml. hypermedia: style: HAL-like detail: >- Every object carries a `_links` object with self, collection, about, author, wp:term, wp:attachment, replies, version-history and predecessor-version relations, plus a `curies` entry defining the wp: prefix. This is the site's only in-band navigation affordance. idempotency: supported: false detail: >- No Idempotency-Key header, parameter or documented retry contract exists anywhere on this surface. The documented operations are all GET and therefore idempotent by HTTP method, but the provider publishes no idempotency contract for unsafe operations. request_tracing: supported: false detail: No request-id or correlation-id header is returned. No trace context is echoed. rate_limiting: supported: false detail: >- No X-RateLimit-*, RateLimit-* (RFC 9331 style) or Retry-After headers were observed on any response. The site sets `Crawl-delay: 10` in /robots.txt, which is a crawler courtesy directive rather than an enforced API limit. Callers should self-throttle. caching: supported: true detail: >- Collection responses return `Cache-Control: max-age=600, must-revalidate`, a 10-minute freshness window. No ETag or Last-Modified was observed, so conditional requests are not available; poll no faster than the cache window. indexing: >- Responses carry `X-Robots-Tag: noindex` — the API output is deliberately excluded from search engines even though it is publicly readable. versioning: scheme: uri-path-namespace detail: >- Version lives in the namespace segment of the path (`/wp-json/wp/v2/...`, `/wp-json/oembed/1.0/...`, `/wp-json/yoast/v1/...`). It is set by the WordPress platform and its plugins, not by Gotham Greens. See lifecycle/gotham-greens-lifecycle.yml. error_envelope: format: wordpress-rest-error rfc9457: false detail: See errors/gotham-greens-problem-types.yml for the shape and the observed code registry. artifact: errors/gotham-greens-problem-types.yml content_negotiation: media_type: application/json; charset=UTF-8 detail: >- JSON only on the wp/v2 and yoast/v1 namespaces. The oEmbed endpoint additionally accepts `format=xml`. There is no CSV, XML or protobuf representation of the content routes. security_headers: x_content_type_options: nosniff detail: >- HSTS was NOT observed on www.gothamgreens.com. See security/gotham-greens-domain-security.yml. cross_links: authentication: authentication/gotham-greens-authentication.yml errors: errors/gotham-greens-problem-types.yml lifecycle: lifecycle/gotham-greens-lifecycle.yml data_model: data-model/gotham-greens-data-model.yml conformance: conformance/gotham-greens-conformance.yml x-evidence: fetched: '2026-08-01' host: https://www.gothamgreens.com headers_observed: - 'x-wp-total: 132' - 'x-wp-totalpages: 66' - 'link: ; rel="next"' - 'cache-control: max-age=600, must-revalidate' - 'x-robots-tag: noindex' - 'x-content-type-options: nosniff' - 'access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link' - 'allow: GET'