generated: '2026-08-25'
method: derived
source: openapi/ (9 documents) + live response headers observed on https://mbracetrx.com/wp-json 2026-08-25
note: >-
  Cross-cutting request/response semantics of the MBrace Therapeutics content API. MBrace publishes
  no API conventions documentation of its own; everything below is the WordPress REST contract as it
  is actually deployed here, derived from the live route index and confirmed against real anonymous
  responses. Idempotency is deliberately NOT claimed and NO `Idempotency` pointer is emitted in
  apis.yml — this deployment exposes no idempotency key, no request-deduplication contract, and no
  anonymous write surface at all.
authentication:
  style: none
  detail: >-
    No credentials required and none accepted for the catalogued surface. See
    authentication/mbrace-therapeutics-authentication.yml.
idempotency:
  supported: false
  header: null
  detail: >-
    No Idempotency-Key header, no client-supplied request identifier and no documented replay
    semantics. Every catalogued operation is a GET and therefore idempotent by HTTP method alone,
    which is not an idempotency contract.
reversibility:
  applicable: false
  grade: na
  detail: >-
    This is a read-only surface. All 28 catalogued operations are GETs; every write route in the
    route index (POST/PUT/PATCH/DELETE on wp/v2 and the plugin namespaces) returned 401 to an
    unauthenticated caller and none was exercised. An agent calling this API cannot take an action
    that would need taking back, so reversibility, dry_run_mode and idempotency are all `na` here
    rather than absent — the denominator, not a zero.
  reversal_operations: []
  windows: []
pagination:
  style: page-number
  params:
    page: Current page of the collection (1-based).
    per_page: Items per page. Minimum 1, maximum 100, default 10.
    offset: Alternative absolute offset into the result set.
  response_headers:
    X-WP-Total: Total number of matching items.
    X-WP-TotalPages: Total number of pages available.
  link_header: >-
    RFC 8288 Link header carrying rel="next" and rel="prev". Observed on
    /wp/v2/posts?per_page=2 as <https://mbracetrx.com/wp-json/wp/v2/posts?per_page=2&page=2>; rel="next".
  cors_exposure: >-
    Access-Control-Expose-Headers advertises X-WP-Total, X-WP-TotalPages and Link, so browser clients
    can read the pagination headers cross-origin.
  bounds_error: >-
    per_page above 100 returns 400 rest_invalid_param with a per-parameter details block, not a
    clamp. Verified live: per_page=999 returned
    'per_page must be between 1 (inclusive) and 100 (inclusive)'.
field_selection:
  supported: true
  params:
    _fields: Comma-separated allow-list of top-level response fields.
    _embed: Inline embeddable resources (author, featured media, terms) under _embedded.
    _envelope: Wrap the response body, status and headers in a single JSON envelope.
  context:
    param: context
    values: [view, embed, edit]
    detail: >-
      Anonymously only `view` and `embed` return data; `edit` requires an authenticated user and
      returns 401.
  practical_note: >-
    _fields matters more than usual on this deployment. /wp/v2/pages returns Elementor-rendered
    page bodies in content.rendered — a single page cost ~200KB on the wire at harvest time, against
    ~3KB for a single media item. An agent should always send _fields on the pages collection.
sorting_and_filtering:
  order: asc | desc (default desc)
  orderby: Per-collection enum — date, id, title, slug, modified, author, include, relevance, menu_order, parent.
  date_windows: after, before, modified_after, modified_before (ISO 8601).
  identity: include / exclude / slug.
  full_text: search, with search_columns (post_title, post_content, post_excerpt) and search_semantics (exact).
  taxonomy: categories, categories_exclude, tags, tags_exclude, tax_relation (AND | OR) on post; categories and tax_relation on board-member, executive-committee and founders.
metadata:
  field: meta
  detail: >-
    A `meta` object is present on the post, page, media, scientific-board and category resources but
    only registered meta keys are exposed; no custom keys are surfaced anonymously.
  extensions_observed:
  - acf — the Advanced Custom Fields REST bridge is active on EVERY content type on this deployment,
    including the five custom post types, but it returned an EMPTY array on every collection sampled
    on 2026-08-25. No custom field group is exposed anonymously, so the structured people data is
    carried in title.rendered and content.rendered rather than in discrete fields.
  - yoast_head and yoast_head_json — rendered and structured Yoast SEO metadata, including a
    schema.org graph, inlined on every post, page, term, user and custom-post-type object.
  - class_list — the CSS class list WordPress would render for the object.
  - filename and filesize — added to media items beyond the WordPress core attachment shape.
request_tracing:
  request_id_header: null
  detail: >-
    No provider request identifier. Cloudflare returns a cf-ray value on every response, which is an
    edge trace token and not an application-level correlation id.
versioning:
  scheme: uri-path-namespace
  current: wp/v2
  detail: >-
    Version is carried in the route namespace (wp/v2, oembed/1.0). MBrace Therapeutics does not
    version this surface itself; it moves when WordPress core and the installed plugins move. See
    lifecycle/mbrace-therapeutics-lifecycle.yml.
error_envelope:
  format: wordpress-rest
  rfc9457: false
  content_type: application/json
  shape: '{ code: string, message: string, data: { status: int, params?: object, details?: object } }'
  detail: >-
    Not RFC 9457 problem+json — there is no `type` URI and no application/problem+json media type.
    See errors/mbrace-therapeutics-problem-types.yml.
rate_limiting:
  signaled: false
  headers: []
  detail: >-
    No RateLimit-* or X-RateLimit-* headers are returned on /wp-json responses. There is an
    unsignalled edge control: a burst of requests from a bare curl user agent was answered with a
    Cloudflare 403 challenge page during this pass, then 200 again once full browser headers were
    sent. robots.txt advertises Crawl-delay: 10. See rate-limits/mbrace-therapeutics-rate-limits.yml.
caching:
  cache_control: 'max-age=600, must-revalidate on /wp-json collection responses'
  headers_observed: [x-cacheable, x-cache, x-cache-group, cf-cache-status, last-modified]
  detail: 'WP Engine object cache (x-cacheable: SHORT) in front of the origin, Cloudflare in front of that.'
indexing:
  x_robots_tag: noindex
  detail: >-
    /wp-json responses carry `x-robots-tag: noindex`, so this surface is deliberately excluded from
    search indexes.
cross_links:
  authentication: authentication/mbrace-therapeutics-authentication.yml
  errors: errors/mbrace-therapeutics-problem-types.yml
  lifecycle: lifecycle/mbrace-therapeutics-lifecycle.yml
  data_model: data-model/mbrace-therapeutics-data-model.yml
  conformance: conformance/mbrace-therapeutics-conformance.yml
  rate_limits: rate-limits/mbrace-therapeutics-rate-limits.yml