generated: '2026-09-04'
method: derived
source: openapi/_ae-authored/vice-media-wp-rest-openapi.yml plus response headers observed live on https://www.vice.com/wp-json/wp/v2/posts
  on 2026-09-04
note: Vice Media publishes no API conventions documentation. Everything below was derived from the live
  contract and from headers observed on the wire; where a convention does not exist, that is recorded
  as an absence rather than filled in.
authentication:
  style: none for reads; HTTP Basic application password or X-WP-Nonce for writes
  ref: authentication/vice-media-authentication.yml
pagination:
  style: page-number
  params:
  - page
  - per_page
  - offset
  defaults:
    per_page: 10
  maximum_per_page: 100
  response_headers:
  - X-WP-Total
  - X-WP-TotalPages
  link_header: RFC 8288 Link header with rel="next" / rel="prev"
  evidence: 'GET https://www.vice.com/wp-json/wp/v2/posts?per_page=1 returned x-wp-total: 822047, x-wp-totalpages:
    822047 and link: <https://www.vice.com/wp-json/wp/v2/posts?per_page=1&page=2>; rel="next", with access-control-expose-headers
    naming X-WP-Total, X-WP-TotalPages and Link.'
  caveat: WordPress refuses deep offsets on very large collections, so the 822,047-post archive is not
    walkable end to end by page number alone; filter by date, category or language.
filtering:
  params:
  - search
  - search_columns
  - search_semantics
  - after
  - before
  - modified_after
  - modified_before
  - categories
  - categories_exclude
  - tags
  - tags_exclude
  - include
  - exclude
  - slug
  - status
  - order
  - orderby
  - _fields
  - _embed
  sparse_fieldsets: _fields — comma-separated allowlist of response properties
  expansion: _embed — inlines linked resources (author, terms, featured media) under _embedded
  note: '`_fields` and `_embed` are WordPress core global parameters and are NOT declared in this host''s
    route-discovery document; both were confirmed by live request on 2026-09-04 (?_fields=id,slug,link
    returned exactly those three keys; ?_embed=1 returned _embedded with author, wp:featuredmedia and
    wp:term). Every other parameter listed here is declared verbatim in the contract.'
hypermedia:
  style: 'HAL-flavoured _links on every resource, plus a `curies` block naming the wp: prefix'
  note: Each response object carries _links.self, _links.collection, _links.about and term links.
metadata:
  supported: true
  field: meta
  note: Per-post arbitrary metadata object, registered per post type.
request_tracing:
  supported: false
  note: vice.com returns no request-id header. api.vice.com does — x-request-id — but that host is entirely
    credential-gated.
versioning:
  scheme: namespace-in-path
  current: wp/v2
  note: The version lives in the route namespace (/wp-json/wp/v2/...). It is WordPress core's version,
    not a version Vice Media sets or publishes a policy for.
  ref: lifecycle/vice-media-lifecycle.yml
error_envelope:
  format: wordpress-rest
  media_type: application/json
  shape:
    code: string
    message: string
    data:
      status: integer
  rfc9457: false
  note: Not RFC 9457 application/problem+json. See errors/vice-media-problem-types.yml.
  ref: errors/vice-media-problem-types.yml
rate_limit_signaling:
  headers: []
  note: No X-RateLimit-*, RateLimit-* or Retry-After header was returned on any observed response, and
    no limit is documented. See rate-limits/vice-media-rate-limits.yml.
  ref: rate-limits/vice-media-rate-limits.yml
caching:
  headers_observed:
  - 'x-cache: BYPASS'
  - 'cache-control: no-cache, must-revalidate, max-age=0, no-store'
  - 'vary: Accept-Encoding, accept, content-type, Origin'
  - 'x-robots-tag: noindex'
  conditional_requests: ETag was not returned on the collection responses observed.
  note: The API responses are explicitly marked noindex and are not cached at the edge.
cors:
  allow_headers:
  - Authorization
  - X-WP-Nonce
  - Content-Disposition
  - Content-MD5
  - Content-Type
  expose_headers:
  - X-WP-Total
  - X-WP-TotalPages
  - Link
idempotency:
  coverage: none
  mechanism: null
  header: null
  note: No idempotency contract exists on this surface. WordPress core ships no Idempotency-Key header,
    none of the 379 derived operations declares one, and nothing in the live route-discovery document
    names a replay-protection parameter. The write surface is additionally unreachable anonymously, so
    the practical exposure is nil — but the honest answer to 'can an agent safely retry a write here'
    is no.
reversibility:
  grade: documented
  note: 'The public surface is read-only: every write operation on both WordPress hosts requires an application
    password or an editor session, and none is obtainable by a third party. Where reversal exists it is
    WordPress core''s own trash/restore semantics, declared in the contract itself, and Vice Media publishes
    no window, retention period or policy for it. No window is asserted here because none is stated anywhere.'
  surfaces:
  - operation: delete_wp_v2_posts_by_id
    reversal: soft delete to trash — pass force=false (the default), then PUT status=publish to restore
    reversal_operation: post_wp_v2_posts_by_id
    window: null
    window_source: null
    note: 'The contract declares a `force` boolean on the delete operation: ''Whether to bypass Trash
      and force deletion.'' With force=false the post moves to trash and can be restored; with force=true
      it is destroyed with no reversal. WordPress''s default trash retention is a core setting the site
      operator can change and Vice Media does not publish its value, so the window is unknown, not 30
      days.'
  - operation: delete_wp_v2_pages_by_id
    reversal: soft delete to trash — pass force=false, then PUT status=publish
    reversal_operation: post_wp_v2_pages_by_id
    window: null
    window_source: null
  - operation: delete_wp_v2_media_by_id
    reversal: soft delete to trash - pass force=false (the default)
    window: null
    window_source: null
    note: This install declares `force` on media deletion as an optional boolean defaulting to false,
      the same as posts and pages - not the force-required form WordPress core uses on media by default.
      Read from the live route-discovery document, not assumed. force=true destroys the attachment with
      no reversal, and no retention window is published for the trash path.
    reversal_operation: post_wp_v2_media_by_id
dry_run_mode:
  supported: false
  note: No dry-run, preview or validate-only parameter exists on the write surface.
bulk:
  supported: true
  operation: post_batch_v1
  note: 'POST /wp-json/batch/v1 accepts a requests[] array with a validation mode of ''require-all-validate''
    or ''normal''. require-all-validate is a pre-flight validation pass, not a transaction: it validates
    every sub-request before any is executed, but it does not roll back a partially applied batch.'