generated: '2026-08-05'
method: derived
source: openapi/star-therapeutics-content-openapi.yml + live response headers observed 2026-08-05
note: >-
  Cross-cutting request/response semantics of the Star Therapeutics content API. Star Therapeutics
  publishes no API conventions documentation of its own; everything below is the WordPress REST
  contract as it is actually deployed here, derived from the route index and confirmed against live
  anonymous responses. Idempotency is deliberately NOT claimed — this deployment exposes no
  idempotency key, no request-deduplication contract, and no anonymous write surface at all, so no
  `Idempotency` pointer is emitted in apis.yml.
authentication:
  style: none
  detail: >-
    No credentials required and none accepted for discovery — the /wp-json/ index reports an empty
    authentication array. See authentication/star-therapeutics-authentication.yml.
idempotency:
  supported: false
  header: null
  detail: >-
    No Idempotency-Key header, no client-supplied request identifier, and no documented replay
    semantics. All catalogued operations are GET and therefore idempotent by HTTP method alone,
    which is not an idempotency contract.
pagination:
  style: page-number
  params:
    page: Current page of the collection (1-based).
    per_page: Items per page. Minimum 1, maximum 100, default 10.
    offset: Alternative absolute offset into the result set.
  response_headers:
    X-WP-Total: Total number of matching items.
    X-WP-TotalPages: Total number of pages available.
  link_header: >-
    RFC 8288 Link header carrying rel="next" and rel="prev". Observed on
    /wp/v2/posts?per_page=2 as <https://star-therapeutics.com/wp-json/wp/v2/posts?per_page=2&page=2>; rel="next".
  cors_exposure: >-
    Access-Control-Expose-Headers advertises X-WP-Total, X-WP-TotalPages, Link, Jet-Query-Total and
    Jet-Query-Pages, so browser clients can read the pagination headers cross-origin.
  bounds_error: >-
    per_page above 100 returns 400 rest_invalid_param with a per-parameter details block, not a
    clamp.
field_selection:
  supported: true
  params:
    _fields: Comma-separated allow-list of top-level response fields.
    _embed: Inline embeddable resources (author, featured media, terms) under _embedded.
    _envelope: Wrap the response body, status and headers in a single JSON envelope.
  context:
    param: context
    values: [view, embed, edit]
    detail: >-
      Anonymously only `view` and `embed` return data; `edit` requires an authenticated user and
      returns 401.
sorting_and_filtering:
  order: asc | desc (default desc)
  orderby: Per-collection enum — date, id, title, slug, modified, author, include, relevance, menu_order.
  date_windows: after, before, modified_after, modified_before (ISO 8601).
  identity: include / exclude / slug.
  full_text: search, with search_columns (post_title, post_content, post_excerpt) and search_semantics.
  taxonomy: categories, categories_exclude, tags, tags_exclude, tax_relation (AND | OR).
metadata:
  field: meta
  detail: >-
    A `meta` object is present on every post-like resource but only registered meta keys are
    exposed; no custom keys are surfaced anonymously on this deployment.
  extensions_observed:
  - yoast_head and yoast_head_json — rendered and structured Yoast SEO metadata, including a
    schema.org graph, inlined on every post and page.
  - featured_image_src and featured_image_src_square — direct featured-image URLs added by the
    Avada theme, saving a second request to /wp/v2/media/{id}.
  - author_info — theme-added author display data on posts (the /wp/v2/users collection itself is
    401-gated, so this is the only anonymous author signal).
  - class_list — the CSS class list WordPress would render for the object.
request_tracing:
  request_id_header: null
  detail: >-
    No provider request identifier. Cloudflare returns a cf-ray value on every response, which is
    an edge trace token and not an application-level correlation id.
versioning:
  scheme: uri-path-namespace
  current: wp/v2
  detail: >-
    Version is carried in the route namespace (wp/v2, oembed/1.0, jet-engine/v1, jet-engine/v2).
    Star Therapeutics does not version this surface itself; it moves when WordPress core and the
    installed plugins move. See lifecycle/star-therapeutics-lifecycle.yml.
error_envelope:
  format: wordpress-rest
  rfc9457: false
  content_type: application/json
  shape: '{ code: string, message: string, data: { status: int, params?: object, details?: object } }'
  detail: >-
    Not RFC 9457 problem+json — there is no `type` URI and no problem+json media type. See
    errors/star-therapeutics-problem-types.yml.
rate_limiting:
  signaled: false
  headers: []
  detail: >-
    No RateLimit-* or X-RateLimit-* headers are returned on /wp-json responses. There is, however,
    an unsignalled edge control: repeated HTML page requests from a non-browser user agent were
    answered with Cloudflare 403 challenges during this pass, then 200 again from a browser user
    agent. /wp-json responses were never challenged. robots.txt advertises Crawl-delay: 10.
caching:
  cache_control: 'max-age=600, must-revalidate on /wp-json collection responses'
  headers_observed: [x-cacheable, x-cache, x-cache-group, cf-cache-status]
  detail: WP Engine object cache in front of the origin, Cloudflare in front of that.
cross_links:
  authentication: authentication/star-therapeutics-authentication.yml
  errors: errors/star-therapeutics-problem-types.yml
  lifecycle: lifecycle/star-therapeutics-lifecycle.yml
  data_model: data-model/star-therapeutics-data-model.yml
  conformance: conformance/star-therapeutics-conformance.yml