Push REST API
Endpoints, authentication and permissions for the mrdw/v1 namespace.
Namespace: mrdw/v1. Base URL: https://your-site.example/wp-json/mrdw/v1.
Two tiers of access
| Tier | Routes | How it is authorised |
|---|---|---|
| Public | POST /register | Firebase App Check |
| Public | DELETE /register, /register/status | The Expo push token itself |
| Admin | /send, /stats, /devices/export, /devices/import | mrdw_manage capability |
The device routes register permission_callback as __return_true deliberately. The app has no
WordPress user, so registration requires Firebase App Check instead. Status and deletion use the
cryptographically random Expo push token as the device credential. These routes grant no access to
the device list and no ability to send.
Admin routes accept any standard WordPress authentication: a logged-in cookie plus nonce, or an
application password over HTTP Basic. Failing the capability check returns 403 mrdw_push_forbidden.
POST /register
Send a valid Firebase token in the X-Firebase-AppCheck header.
{
"expo_token": "ExponentPushToken[xxxxxxxxxxxxxxxxxxxxxx]",
"device_type": "ios",
"device_model": "iPhone 15 Pro",
"os_version": "18.2",
"app_version": "1.4.0",
"locale": "en-US",
"timezone": "America/Chicago",
"user_label": "Nathanial's phone"
}expo_token and device_type are required; device_type must be ios or android. Everything
else is optional. Re-registering an existing token updates that device.
DELETE /register
Takes expo_token and marks the device inactive so it stops receiving sends.
GET /register/status
Takes expo_token and reports whether it is registered and active. Use it on app launch to decide
whether to prompt for notification permission again.
Admin routes
| Route | Method | Purpose |
|---|---|---|
/send | POST | Send or schedule a notification. |
/stats | GET | Device and delivery counts. |
/devices/export | GET | CSV of the device list. |
/devices/import | POST | CSV upload; MIME-checked, CSV only. |
Disabled module
With the Push module switched off under MrDemonWolf → General, none of these routes are
registered and all of them return 404.