REST API

All Payment Page routes are registered under the namespace payment-page/v1. The full URL of each route is therefore /wp-json/payment-page/v1/<route>. The plugin does not register any other namespaces.

Security model#

Route groups use these security controls:

• Admin routes — permission_callback checks current_user_can( 'payment_page_settings' ). The payment_page_settings capability is added to the administrator role at activation.
• Public checkout and payment routes — these accept requests without a WordPress login, then validate the signed Payment Page payment reference, checkout context, allowed gateway/method, amount, currency, mode, and applicable rate limits before acting. New payment rows are rate-limited; updates require the payment ID plus the HMAC-SHA256 secret returned when the row was created.
• Public webhook routes — Stripe verifies the Stripe-Signature header against the configured per-mode webhook signing secret. PayPal requires its complete transmission-signature header set and verifies it through PayPal using the per-mode Webhook ID and API credentials.
• Public bundled-preview route — returns deterministic template metadata as SVG and does not expose merchant payment data.

There is no WordPress nonce on the public routes. Public routes were designed to be hit by the customer's browser or a payment provider, which never carries a WP nonce.

Administration (admin-only)#

Source: app/RestAPI/Administration.php.

Payment Gateway (admin-only, with one public callback)#

Source: app/RestAPI/PaymentGateway.php.

Plugin install / activate (admin-only, restricted to elementor)#

Source: app/RestAPI/Plugin.php. Both routes only accept the slug elementor — they exist to install Elementor on demand from the Quick Setup wizard, not as a generic plugin installer.

Stripe (public, secret-protected)#

Source: app/RestAPI/Stripe.php. These are the front-end-facing endpoints the customer's browser calls during checkout. The free plan proxies these calls through api.paymentpageplugin.com/wp-json/payment-page-api/v1/ (which attaches a 2% application_fee_amount); the Pro plan calls Stripe directly with no fee.

ACH Direct Debit does not register separate Plaid REST routes in Payment Page 1.5.3. The Pro-only ACH flow uses Stripe Financial Connections and the Payment Intent created by /stripe/payment-intent-or-setup.

Payment records and status (public, capability-protected)#

Source: app/RestAPI/Payment.php.

PayPal Standard Checkout (public, capability-protected)#

Source: app/RestAPI/PayPal.php. Both routes are limited to PayPal Standard one-time payments and validate the signed local payment reference before making a server-side PayPal request.

Bundled template previews (public)#

Source: app/Templates/BundledTemplates.php.

Tagging (admin-only)#

Source: app/RestAPI/Tagging.php.

Webhooks (public, signature-verified)#

Source: app/RestAPI/Webhook.php.

{mode} is live or test. Payment Page 1.5.3 accepts payment_intent.succeeded, payment_intent.payment_failed, payment_intent.processing, payment_intent.canceled, setup_intent.succeeded, setup_intent.setup_failed, setup_intent.canceled, invoice.paid, invoice.payment_failed, customer.subscription.created, customer.subscription.updated, and customer.subscription.deleted.

After a successful Stripe Connect OAuth callback, a new Payment Page endpoint is provisioned with that exact list. A bounded background task can update an existing Payment Page 1.5.2 endpoint in place without deleting it, changing its API version, or rotating its signing secret. A manually managed endpoint is not altered. Stripe checkout for a mode remains paused until the event contract is automatically verified or an administrator saves the completed manual configuration. See Stripe Webhook Configuration and PayPal Webhook Configuration.

Example — dashboard payload#

A GET /wp-json/payment-page/v1/administration/dashboard request returns the data the admin SPA needs to render the Payment Gateways screen. The response shape (abridged) looks like this:

{
  "skipped_quick_setup": 0,
  "quick_setup_steps": [
    { "id": "connect_payment_gateway", "is_complete": 0 },
    { "id": "connect_stripe_test_gateway", "is_complete": 0 },
    { "id": "connect_stripe_live_gateway", "is_complete": 0 },
    { "id": "select_template", "is_complete": 0 }
  ],
  "payment_gateways": {
    "stripe": {
      "is_connected": 1,
      "is_live": 0,
      "active_payment_methods": ["ccard", "sepa", "apple_pay", "google_pay", "alipay", "wechat"]
    },
    "paypal": {
      "is_connected": 0,
      "active_payment_methods": ["standard_checkout"]
    }
  }
}

The exact shape is built by app/RestAPI/Administration.php and may include additional keys for templates, notifications, and Freemius status.

Calling a route from PHP#

If you need to invoke a Payment Page route from another plugin, the standard WordPress REST API helpers work as expected:

$request  = new WP_REST_Request( 'GET', '/payment-page/v1/administration/dashboard' );
$response = rest_do_request( $request );
$data     = $response->get_data();

For the admin routes, the calling user must have the payment_page_settings capability — typically that means administrator.

Plugin constants#

The plugin defines several constants you can reference from your own code. They are declared in payment-page.php and lib/definitions.php:

• PAYMENT_PAGE_NAME — 'Payment Page'
• PAYMENT_PAGE_ALIAS — 'payment_page' (used as the option-name and transient prefix)
• PAYMENT_PAGE_PREFIX — 'payment-page' (used in the menu slug, text domain, and REST namespace)
• PAYMENT_PAGE_REST_API_PREFIX — alias of PAYMENT_PAGE_PREFIX (the REST namespace)
• PAYMENT_PAGE_ADMIN_CAP — 'payment_page_settings'
• PAYMENT_PAGE_VERSION — current plugin version
• PAYMENT_PAGE_POST_TYPE_PAYMENT_FORM — 'pp_payment_form'
• PAYMENT_PAGE_TABLE_STRIPE_CUSTOMERS, _STRIPE_PRODUCTS, _STRIPE_PRICES, _PAYMENTS, _LOG — database table names

Example use:

if ( current_user_can( PAYMENT_PAGE_ADMIN_CAP ) ) {
    // Code that should only run for users who can manage Payment Page settings.
}

If you need help integrating with these routes, contact support.