generated: '2026-08-22'
method: derived
source: openapi/ + live response headers and error bodies observed on https://iecure.com/wp-json 2026-08-22
note: >-
  Cross-cutting request/response semantics of the iECURE content API. iECURE publishes no API
  conventions documentation of its own; everything below is the WordPress REST contract as it is
  actually deployed here, derived from the route index and confirmed against live anonymous
  responses. Idempotency is deliberately NOT claimed — this deployment exposes no idempotency key,
  no request-deduplication contract, and no anonymous write surface at all, so no `Idempotency`
  pointer is emitted in apis.yml.
authentication:
  style: none
  detail: >-
    No credentials required for any catalogued operation. The /wp-json/ index advertises WordPress
    Application Passwords over HTTP Basic, but that is a staff editorial credential with no
    self-service issuance. See authentication/iecure-authentication.yml.
idempotency:
  supported: false
  header: null
  detail: >-
    No Idempotency-Key header, no client-supplied request identifier, and no documented replay
    semantics. Every catalogued operation is a GET and therefore idempotent by HTTP method alone,
    which is not an idempotency contract.
pagination:
  style: page-number
  params:
    page: Current page of the collection (1-based, minimum 1, default 1).
    per_page: Items per page. Minimum 1, maximum 100, default 10.
    offset: Alternative absolute offset into the result set.
  response_headers:
    X-WP-Total: Total number of matching items. Observed as 60 on /wp/v2/posts.
    X-WP-TotalPages: Total number of pages available. Observed as 30 on /wp/v2/posts?per_page=2.
    Link: RFC 8288 links carrying rel="next" and rel="prev".
  link_header_observed: '<https://iecure.com/wp-json/wp/v2/posts?per_page=2&page=2>; rel="next"'
  cors_exposure: >-
    Access-Control-Expose-Headers advertises X-WP-Total, X-WP-TotalPages and Link, so browser
    clients can read the pagination headers cross-origin. Access-Control-Allow-Headers advertises
    Authorization, X-WP-Nonce, Content-Disposition, Content-MD5 and Content-Type.
  bounds_error: >-
    per_page above 100 returns 400 rest_invalid_param with a per-parameter details block carrying
    the nested code rest_out_of_bounds — it does not clamp.
field_selection:
  supported: true
  params:
    _fields: Comma-separated allow-list of top-level response fields.
    _embed: Inline embeddable resources (author, featured media, terms) under _embedded.
    _envelope: Wrap the response body, status and headers in a single JSON envelope.
  context:
    param: context
    values: [view, embed, edit]
    detail: Anonymously only `view` and `embed` return data; `edit` requires an authenticated user.
sorting_and_filtering:
  order: asc | desc (default desc)
  orderby: Per-collection enum — date, id, title, slug, modified, author, include, relevance, menu_order.
  date_windows: after, before, modified_after, modified_before (ISO 8601 date-time).
  identity: include / exclude / slug.
  full_text: search, with search_columns (post_title, post_content, post_excerpt) and search_semantics.
  taxonomy: >-
    categories / categories_exclude and tags / tags_exclude on posts; portfolio_entries /
    portfolio_entries_exclude on the team collection; tax_relation (AND | OR).
metadata:
  field: meta
  detail: >-
    A `meta` object is present on every post-like resource but only registered meta keys are
    exposed; no custom keys are surfaced anonymously on this deployment.
  extensions_observed:
  - aioseo_head_json — All in One SEO structured metadata inlined on posts and pages.
  - class_list — the CSS class list WordPress would render for the object.
  - The `portfolio` post type is repurposed to carry team members, so its objects read as people
    rather than work samples. See data-model/iecure-data-model.yml.
request_tracing:
  request_id_header: null
  detail: >-
    No provider request identifier. Cloudflare returns cf-ray on every response and Kinsta returns
    ki-edge / ki-origin / ki-cache-type; these are infrastructure trace tokens, not application-level
    correlation ids a consumer can quote back to support.
versioning:
  scheme: uri-path-namespace
  current: wp/v2
  detail: >-
    Version is carried in the route namespace. Namespaces observed 2026-08-22: oembed/1.0, aioseo/v1,
    wp-umbrella/v1, duplicate-post/v1, wp-analytify/v1, regenerate-thumbnails/v1, wp/v2,
    wp-site-health/v1, wp-block-editor/v1, wp-abilities/v1. iECURE does not version this surface
    itself; it moves when WordPress core and the installed plugins move. See lifecycle/.
error_envelope:
  format: wordpress-rest
  rfc9457: false
  content_type: application/json
  shape: '{ code: string, message: string, data: { status: int, params?: object, details?: object } }'
  detail: >-
    Not RFC 9457 problem details — there is no `type` URI and no application/problem+json media
    type. See errors/iecure-problem-types.yml.
rate_limiting:
  signaled: false
  headers: []
  detail: >-
    No RateLimit-* or X-RateLimit-* headers are returned on /wp-json responses, and no Retry-After
    was observed. See rate-limits/iecure-rate-limits.yml.
caching:
  headers_observed: [cf-cache-status, x-kinsta-cache, ki-cache-type, ki-edge, ki-origin, vary, alt-svc]
  detail: >-
    cf-cache-status DYNAMIC and x-kinsta-cache BYPASS on /wp-json responses — the REST surface is
    not edge-cached. Kinsta origin behind Cloudflare.
  robots: >-
    /wp-json responses carry `x-robots-tag: noindex`, so the API surface is deliberately kept out of
    search indexes even though it is open to any anonymous caller.
reversibility:
  applicable: false
  grade: na
  detail: >-
    The catalogued surface is read-only. Every operation described in openapi/ is a GET; no create,
    update or delete operation is reachable without an authenticated WordPress user, and none was
    exercised. There is therefore nothing to reverse and no reversal window to state. dry_run_mode
    and idempotency are `na` for the same reason. This is an honest not-applicable, not a gap: the
    write half of the WordPress REST API exists in the route index but is closed to public callers.
  write_surfaces: []
  reversal_operations: []
cross_links:
  authentication: authentication/iecure-authentication.yml
  errors: errors/iecure-problem-types.yml
  lifecycle: lifecycle/iecure-lifecycle.yml
  data_model: data-model/iecure-data-model.yml
  conformance: conformance/iecure-conformance.yml
  rate_limits: rate-limits/iecure-rate-limits.yml