Developer API Reference

Overview #

VendMizer is a standalone store: it runs on its own database tables and its own REST API rather than on WordPress posts. Everything the admin screens do, they do by calling that API — so anything you can do in the dashboard, you can also do from your own code. The whole API lives under one namespace, vendmizer/v1.

With it you can, for example:

• Read and write orders, products, customers, inventory, coupons and categories.
• Drive a storefront — cart, checkout and account flows — from a custom or headless front end.
• Receive webhooks when store events happen, and hook into around 145 actions and filters in PHP.
• Manage shipping, currencies, taxes and settings programmatically.

Base URL and versioning #

Every endpoint is exposed through the WordPress REST API under the vendmizer/v1 namespace. The base URL is your site address followed by the REST path:

https://your-site.com/wp-json/vendmizer/v1/

So the product list is requested as:

GET https://your-site.com/wp-json/vendmizer/v1/products

The v1 in the namespace is the API version. Backward-compatible additions are made within v1; any breaking change would ship under a new version, so existing integrations keep working.

Authentication #

Endpoints fall into three access levels; each endpoint in this reference is marked with the level it needs.

Logged-in requests (cookie + nonce)

For requests from within a logged-in WordPress session — the dashboard, or your own admin-side JavaScript — authentication is the standard WordPress REST nonce: send a valid wp_rest nonce in the X-WP-Nonce header (WordPress exposes one to enqueued scripts as wpApiSettings.nonce).

fetch("/wp-json/vendmizer/v1/orders", {
  headers: { "X-WP-Nonce": wpApiSettings.nonce },
  credentials: "same-origin"
})
  .then(function (r) { return r.json(); })
  .then(function (data) { console.log(data.items); });

External clients (Application Passwords)

For server-to-server or external integrations, use WordPress Application Passwords (Users → Profile → Application Passwords) with HTTP Basic authentication over HTTPS. The user's capabilities still apply.

curl https://your-site.com/wp-json/vendmizer/v1/products \
  --user "admin:xxxx xxxx xxxx xxxx xxxx xxxx"

Conventions #

Resource IDs

Records are addressed by an opaque UUID rather than a sequential integer — for example /orders/3f1c8a2e-…. Actions on a record are nested paths, such as /orders/{uuid}/status or /orders/{uuid}/recalc-tax.

Pagination

List endpoints accept page (default 1) and per_page (default 20, maximum 100). The response reports the totals so you can page through the full set:

GET /wp-json/vendmizer/v1/orders?page=2&per_page=50

{
  "items": [ ... ],
  "total": 348,
  "pages": 7,
  "page":  2
}

Responses

Responses are JSON. List endpoints return an items array with the pagination fields above. Single-record and action endpoints return the record under data, or a confirmation message, alongside a success flag:

{ "success": true, "data": { ... } }
{ "success": true, "message": "Order updated." }

Errors

Errors use the standard WordPress REST shape: a machine-readable code, a human-readable message, and the HTTP status under data.status. The HTTP response carries that same status.

HTTP/1.1 400 Bad Request

{
  "code": "amount_mismatch",
  "message": "The payment amount does not match the order total.",
  "data": { "status": 400 }
}

Rate limiting

Public and storefront endpoints are rate-limited per client to protect the store from abuse. Normal use is unaffected; if you exceed a limit you receive a 429 and can retry shortly after.

Storefront & checkout #

These endpoints power a custom or headless storefront. Reads are public; guest writes (cart, checkout, payment) are callable without login but must carry the site REST nonce; account endpoints require a signed-in customer.

Auth levels below: Public (open), Storefront (guest-callable, send the site REST nonce), Customer (signed-in customer, own data), Staff (capability-gated), Signed (provider-signed webhook).

Store

Cart

Checkout

Account (signed-in customer)

Catalog & inventory #

Manage the catalog. These are dashboard operations and require a signed-in user with the right capability (Staff).

Products

Categories, brands & attributes

Inventory

Reviews

Orders, customers & coupons #

The core commerce records. All are Staff (dashboard) operations; a customer reads their own orders through the Account endpoints above.

Orders

Customers

Coupons

Shipping, tax & currencies #

Shipping

Tax

Currencies

Settings #

Read and write store configuration. Settings are grouped; a group is addressed by its key.

Webhooks #

VendMizer works with webhooks in two directions.

Outbound: subscribe to store events (Staff)

Register your own endpoints and VendMizer will POST to them when events occur; deliveries are logged and retryable.

Inbound: provider receivers (Signed)

These are called by payment and shipping providers, not by you. Each verifies the provider’s signature before acting.

Pro modules #

VendMizer Pro adds several modules on the same vendmizer/v1 namespace — the same base URL, authentication tiers and conventions as the free API. The endpoints below need the Pro plugin active and a valid licence; every Pro route is tagged Pro in the full endpoint list at the end of this page.

Point of Sale (POS)

Run in-person sales from a register: open and close sessions, ring up sales, hold and resume carts, manage the cash drawer, and pull session analytics.

Subscriptions & recurring billing

Manage subscriptions store-side, and let customers manage their own from the account area.

Marketing & automations

Campaigns, event-driven automations, customer segments, abandoned-cart recovery and Mailchimp sync.

WhatsApp & SMS

A WhatsApp inbox with an optional LLM chatbot, plus transactional SMS with templates.

Affiliates

Returns & support tickets

Loyalty, store credit & gift cards

Multi-branch & AI

Hooks for developers #

Beyond the REST API, VendMizer fires around 145 vendm_* actions and filters, so you can react to store events and change behaviour from a small plugin or your theme’s functions.php — no core edits. Use the standard add_action() and add_filter(). A selection of the most useful:

Actions — react to events

Filters — change behaviour

Pro hooks (require VendMizer Pro)

VendMizer Pro fires a further set of vendm_* hooks — chiefly around AI and the WhatsApp inbox — in addition to the ones above. These are registered only when Pro is active.

Actions — Pro events you can react to:

Filters — Pro behaviour you can change:

Examples #

List orders (server-to-server, Application Password)

curl "https://your-site.com/wp-json/vendmizer/v1/orders?per_page=20" \
  --user "admin:xxxx xxxx xxxx xxxx xxxx xxxx"

Read public storefront data (browser, no login)

// Public read — no authentication needed
const res = await fetch("/wp-json/vendmizer/v1/store/currencies");
const currencies = await res.json();
console.log(currencies);

Write from the storefront (guest, with the site nonce)

// Guest cart write — send the site REST nonce
await fetch("/wp-json/vendmizer/v1/cart/add", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-WP-Nonce": vmzConfig.nonce
  },
  body: JSON.stringify({ product_id: 123, qty: 1 })
});

Add custom checkout validation (PHP filter)

add_filter( 'vendm_checkout_validate_fields', function ( $result, $body, $settings ) {
    if ( empty( $body['company'] ) ) {
        return new WP_Error(
            'company_required',
            'A company name is required.',
            array( 'status' => 400 )
        );
    }
    return $result; // null = valid, WP_Error blocks checkout
}, 10, 3 );

React to a new order (PHP action)

add_action( 'vendm_order_created', function ( $order_id, $context ) {
    // e.g. push the order to an external ERP
    error_log( 'New VendMizer order: ' . $order_id );
}, 10, 2 );

Override cart pricing (PHP filter)

add_filter( 'vendm_cart_item_unit_price', function ( $price, $extra, $product, $variation ) {
    // your pricing logic here; return the per-unit price
    return $price;
}, 10, 4 );

Full endpoint list #

Every REST endpoint in the vendmizer/v1 namespace, generated directly from the source so it never drifts — the free plugin, plus (where marked Pro) the endpoints VendMizer Pro adds. Auth column: Public / Storefront (site nonce) / Customer / Staff / Signed. Regenerate with bin/build-api-endpoints.mjs on each release.

569 endpoints in the vendmizer/v1 namespace — 332 Free, 237 Pro (generated 2026-09-20).