API Reference
Auth & headers
All Ingest and apps statistics endpoints require a valid wp_live_* API key in the Authorization header. Keys are scoped to one developer app in one organization.
Bearer token
Generate keys from Organization → Developer. The plaintext is shown once; store it in your secrets manager. Revoke compromised keys immediately.
Authorization: Bearer wp_live_9f3c3e4c1e9b4b2d9c1e3f4b2c3d4e5fValidate with GET ping. Auth failures return 401 with codes like missing_authorization, invalid_key, key_revoked, or key_expired — see error codes.
Common headers
| Field | Type | Notes |
|---|---|---|
| Authorization | Bearer wp_live_* | Required on every request. |
| Content-Type | application/json | Required on POST/PUT with a body. |
| Idempotency-Key | string ≤ 200 | Recommended on all writes. Replay-safe 10 min. |
| X-WePeople-API-Version | date string | Optional client pin; echoed on responses. |
Rate-limited responses include X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, and Retry-After when applicable.
Idempotency
Send Idempotency-Key on POST events and POST snapshots. The first response for a given (apiKey, key) pair is cached for ten minutes and replayed verbatim — safe for at-least-once delivery from queues and cron.
Idempotency-Key: deploy-batch-20260419-001CORS
/api/v1/ingest/* and /api/v1/apps/statistics advertise:
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: Authorization, Content-Type, Idempotency-Key, X-WePeople-API-VersionHosted MCP at /api/mcp does not use open CORS — desktop MCP clients connect server-side. See Hosted MCP.
API version
Responses include X-WePeople-API-Version (currently a dated string). Clients may send the same header to pin behavior during upgrades. Breaking changes ship with a new version header and updated OpenAPI spec.