153 governed abilities, each off until you say otherwise.

Read a single allowlisted meta value from a post the agent can edit (scalar only).

Read every allowlisted scalar meta value from a post the agent can edit, returned as a key/value map. Protected, underscore, and non-scalar values are excluded.

Write a single allowlisted scalar meta value to a post the agent can edit.

Delete an allowlisted meta key from a post the agent can edit. Removes all values of that key.

List pages filtered by status and search term. Each item returns id, title, status, type, slug, link, author {id, display_name}, dates, excerpt, terms grouped by taxonomy, featured_image {id, url, alt} or null, and allowlisted meta. Set include_content=true to also return full content per item. Response includes total.

Retrieve a single page by ID. Returns id, title, status, type, slug, link, author {id, display_name}, dates, full content (rendered HTML by default, or raw markup via content_format; omitted for password-protected pages), excerpt, terms grouped by taxonomy, featured_image {id, url, alt} or null, and meta (allowlisted scalar values only).

Create and publish a page (requires publish_pages). Optional: slug, featured_media (attachment id), terms ({taxonomy: [termId]}, replaces existing terms per taxonomy), and meta ({key: value}, allowlisted keys only).

Update an existing page by ID (publishing is a separate gate). Optional: slug, featured_media (attachment id), terms ({taxonomy: [termId]}, replaces existing terms per taxonomy), and meta ({key: value}, allowlisted keys only).

Move a page to trash (recoverable, never permanently deleted).

Permanently delete a page, bypassing the Trash. This cannot be undone - use trash-page to remove a page recoverably instead.

List posts filtered by type, status, and search term. Each item returns id, title, status, type, slug, link, author {id, display_name}, dates, excerpt, terms grouped by taxonomy, featured_image {id, url, alt} or null, and allowlisted meta. Set include_content=true to also return full content per item; content_format (rendered or raw) only takes effect when include_content is true. Response includes total.

Count posts of an allowlisted post type: a total of active (non-trashed) items, plus a breakdown by status (publish, draft, pending, private, future, trash). Trash and auto-draft are shown in the breakdown but excluded from total.

Retrieve a single post by ID. Returns id, title, status, type, slug, link, author {id, display_name}, dates, full content (rendered HTML by default, or raw markup via content_format; omitted for password-protected posts), excerpt, terms grouped by taxonomy, featured_image {id, url, alt} or null, and meta (allowlisted scalar values only).

Create a new draft post. The agent drafts; a human publishes. Optional: slug, featured_media (attachment id), terms ({taxonomy: [termId]}, replaces existing terms per taxonomy), and meta ({key: value}, allowlisted keys only).

Create and publish a post (requires publish capability). Optional: slug, featured_media (attachment id), terms ({taxonomy: [termId]}, replaces existing terms per taxonomy), and meta ({key: value}, allowlisted keys only).

Update an existing post by ID (publishing is a separate gate). Optional: slug, featured_media (attachment id), terms ({taxonomy: [termId]}, replaces existing terms per taxonomy), and meta ({key: value}, allowlisted keys only).

Literal find-and-replace inside a post's content. Sanitizes the result and edits only the body; status is never touched. Reversible via revisions.

Move a post to trash (recoverable, never permanently deleted).

Create an item of an allowlisted custom content type (post_type). Drafts unless the type's publish capability is held.

Update an item of an allowlisted custom content type by ID (publishing requires that type's publish capability).

Permanently delete a post, bypassing the Trash. This cannot be undone - use trash-post to remove a post recoverably instead.

List the revisions of a post the agent can edit (metadata only - no body content).

Get a single revision of a post the agent can edit, including its body content (rendered or raw) and an optional diff against the post's current content.

Restore a post to one of its revisions. The current state is first saved as a fresh revision, so the restore is reversible.

Permanently delete a single revision from a post's history. This cannot be undone (unlike trashing a post, there is no Trash for revisions). The live post is not changed. Requires edit access to the parent post.

Append terms to a post (does not replace existing terms). Requires edit access to the post and the taxonomy's assign_terms capability.

List terms (with counts) for a public taxonomy. Response includes total (the full match count for the taxonomy and search).

Create a term in a public taxonomy (requires manage_categories).

Update a term in a public taxonomy, with a circular-hierarchy guard on reparenting.

Read a single term (by id) from a public taxonomy.

Read a single allowlisted scalar meta value from a term in a public taxonomy.

Write a single allowlisted scalar meta value to a term you can edit.

Delete an allowlisted meta key from a term you can edit. Removes all values of that key.

List approved comments for a post (email and IP are never returned).

List the moderation queue (requires moderate_comments).

Approve, unapprove, spam, or trash a comment (requires moderate_comments).

Read one comment by id (email and IP are never returned).

Add a pending comment to a post as the agent user (requires moderate_comments).

Edit a comment's content (requires edit access to that comment).

Permanently delete a comment (not recoverable; use moderate-comment to trash recoverably).

Read a single allowlisted scalar meta value from a user the agent can edit. Auth, capability, and 2FA keys are never readable.

Write a single allowlisted scalar meta value to a user the agent can edit. Auth, capability, and 2FA keys are blocked outright.

Delete an allowlisted meta key from a user the agent can edit. Removes all values of that key. Auth and capability keys can never be touched.

List users: id, display name, email, roles, and post count. Response includes total (the full match count). Gated by the list-users capability. Never login or password.

Read one user by id: id, display name, email, roles, post count, registration date, and bio. Never login or password.

Create a new user with the site default role (never a caller-chosen role). Requires the create-users capability. Off by default.

Edit a user's display name, name, or email by id. Changing a role needs the promote-users capability and never demotes the last administrator.

Permanently delete a user and reassign their content to another user. Never deletes you or the last administrator. Requires the delete-users capability. Off by default.

List media library items (URL, alt, mime, dimensions). Response includes total (the full match count).

Read one media item by id: caption, description, date, filesize, parent, and all image sizes.

Count media library items, total and broken down by mime type.

Set a post's featured image to an existing image attachment ID.

Upload an image from base64 data (jpg, png, gif, webp; SVG rejected).

Update an attachment's title, alt text, caption, or description.

Permanently delete an attachment - the file and library entry are removed and cannot be recovered.

Reads this plugin's own audit log: each row's ability name, status (started, success, error, denied), acting user id and login, the argument keys passed, and the timestamp. Most recent first. Response includes total (the count for the status filter). Never argument values or network addresses. Requires the manage-options capability.

Read a small allowlist of site settings: name, tagline, timezone, date and time formats, week start, and posts per page. Requires the manage-options capability. Never the site URL or admin email.

Write a small allowlist of site settings, passed as a settings object whose keys are the setting names and values the new values. Accepted keys: blogname (site name), blogdescription (tagline), timezone_string, date_format, time_format, start_of_week (0-6), posts_per_page (1-100). String values are sanitized; the two integer settings are clamped into their legal ranges. Any unrecognized key rejects the entire call with nothing written. It can never change the site URL, admin email, default role, or open registration. Requires manage-options. Off by default.

List public taxonomies registered on the site.

List public post types registered on the site. Each type includes a writable flag indicating whether agents may create/update items of that type.

Retrieve the site name, tagline, URL, and language.

Lists installed plugins with their name, version, and active state. Read-only - it can never activate, deactivate, or change a plugin. Requires the activate-plugins capability.

Reads the active theme: name, version, stylesheet, parent, and whether it is a block theme. Requires the edit-theme-options capability.

Lists installed themes by name, version, stylesheet, and active state. Requires the edit-theme-options capability.

Lists block templates (or template parts) by id, slug, title, type, and source. Requires the edit-theme-options capability.

Reads one block template by id, including its markup. Requires the edit-theme-options capability.

Reads the active theme's resolved global styles and settings (theme.json). Requires the edit-theme-options capability.

Updates a database block template by id. Its markup is sanitized, and theme-file templates cannot be edited. Requires the edit-theme-options capability.

Lists reusable blocks (synced patterns) by id, title, slug, status, and modified date. No block markup in the list. Response includes total (the query-wide count of matching blocks). Requires the edit-posts capability.

Reads one reusable block by id, including its raw block markup. Requires edit access to that block.

Creates a reusable block (published immediately). Its markup is sanitized, and the author is always the agent. Requires the publish-posts capability.

Updates a reusable block's title or markup by id. The markup is sanitized. Requires edit access to that block.

Moves a reusable block to the Trash, where you can restore it. Never a permanent delete. Requires delete access to that block.

Lists the navigation menus by id, name, slug, and item count. Requires the edit-theme-options capability.

Reads one navigation menu by id: its name, slug, and item count. Requires the edit-theme-options capability.

Lists the items in a navigation menu by id: each item id, title, URL, what it links to, and its place in the order. Requires the edit-theme-options capability.

Creates a navigation menu by name. Requires the edit-theme-options capability.

Renames a navigation menu by id. Requires the edit-theme-options capability.

Permanently deletes a navigation menu and all of its items. Requires the edit-theme-options capability.

Adds an item (link) to a navigation menu. Requires the edit-theme-options capability.

Updates a menu item's title or URL by id. Requires the edit-theme-options capability.

Permanently removes one item from a navigation menu. Requires the edit-theme-options capability.

Search across the exposed content types in one query. Each result returns id, title, status, type, slug, link, author {id, display_name}, dates, excerpt, terms grouped by taxonomy, featured_image {id, url, alt} or null, and allowlisted meta. Set include_content=true to also return full content per result. Response includes total.

Reads a post's Yoast SEO fields (title, description, focus keyword, canonical, social, and the three robots directives) from its _yoast_wpseo_* post meta. Requires edit access to that post.

Writes a post's Yoast SEO fields to its _yoast_wpseo_* post meta. URL fields are sanitized as URLs and the robots directives are validated. Requires edit access to that post.

Reads the rendered SEO head markup for a post from Yoast, best-effort: the returned head string is empty when Yoast exposes no head API for that post. Requires the edit-posts capability and edit access to that post.

Reads a post's Rank Math SEO fields (title, description, focus keyword, canonical, social, and robots) from its rank_math_* post meta. Requires edit access to that post.

Writes a post's Rank Math SEO fields to its rank_math_* post meta. URL fields are sanitized as URLs and robots is stored as Rank Math's serialized directive array. Requires edit access to that post.

Reads a post's structured-data (JSON-LD) schema of a given type from Rank Math's rank_math_schema_{Type} post meta. Requires edit access to that post.

Writes a post's structured-data (JSON-LD) schema of a given type to Rank Math's rank_math_schema_{Type} post meta, recursively sanitized. Requires edit access to that post.

Reads the rendered SEO head markup for a post from Rank Math, best-effort (empty when no head API is available). Requires the edit-posts capability and edit access to that post.

Reads a post's SEO fields (title, description, canonical, social, and robots) from All in One SEO's own data store, not post meta. Requires edit access to that post.

Writes a post's SEO fields through All in One SEO's own data store (not post meta). URL fields are sanitized as URLs. Requires edit access to that post.

Reads the rendered SEO head markup for a post from All in One SEO, best-effort: the returned head string is empty when All in One SEO renders no head for that post. Requires the edit-posts capability and edit access to that post.

Lists the ACF field groups and the fields inside each (key, label, and type) for discovery. It returns structure only, never stored values. Requires the edit-posts capability.

Reads all of a post's ACF field values, hydrated by field key. Requires edit access to that post.

Writes ACF field values on a post by field key, each value sanitized for its field type. Requires edit access to that post.

Reads all of a term's ACF field values, hydrated by field key. Requires edit access to that term.

Writes ACF field values on a term by field key, each value sanitized for its field type. Requires edit access to that term.

Reads all of a user's ACF field values, hydrated by field key. A field of the user_email type returns the real email address under the integration disclaimer. Requires edit access to that user.

Writes ACF field values on a user by field key, each value sanitized for its field type. Requires edit access to that user.

Lists all global WooCommerce product attribute taxonomies with their id, name (label), slug, type, sort order, and archive flag. Requires the manage-WooCommerce capability.

Creates a new global WooCommerce product attribute taxonomy from a name (required) plus optional slug, type, sort order, and archive flag. Requires the manage-WooCommerce capability.

Updates a global WooCommerce product attribute taxonomy by id, changing only the fields you send. Requires the manage-WooCommerce capability.

Lists WooCommerce coupons with their id, code, amount, discount type, expiry date, and usage count, plus a total. Requires the manage-WooCommerce capability.

Reads one WooCommerce coupon by id: code, amount, discount type, expiry, usage limits, spend limits, product and email restrictions, and other config. Requires the manage-WooCommerce capability.

Creates a WooCommerce coupon from a code and discount type, with optional amount, usage limits, spend limits, product restrictions, and email restrictions. Returns the full coupon shape. Requires the manage-WooCommerce capability.

Updates a WooCommerce coupon by id, changing only the fields you send. An empty request body is a no-op success. Returns the full coupon shape. Requires the manage-WooCommerce capability.

Lists WooCommerce customers with their id, email, name, username, order count, and total spent. Customer email is returned in full under the Integrations security disclaimer. Requires the manage-WooCommerce capability.

Reads one WooCommerce customer by id, including email, name, username, order count, total spent, date created, and the full billing address (including phone) and shipping address. Customer PII is returned in full under the Integrations security disclaimer. Requires the manage-WooCommerce capability.

Creates a WooCommerce customer from an email and username, with optional first name, last name, and billing/shipping address. Returns the full customer shape including PII under the Integrations security disclaimer. Requires the manage-WooCommerce capability.

Updates a WooCommerce customer by id, changing only the fields you send. An empty request body is a no-op success. Returns the full customer shape. Requires the manage-WooCommerce capability.

Lists all registered WooCommerce payment gateways with their id, title, and enabled state. Secret or credential settings are never returned. Requires the manage-WooCommerce capability.

Reads one WooCommerce payment gateway by id, including its title, description, enabled state, order, and non-secret settings. Credential and key fields are always redacted. Requires the manage-WooCommerce capability.

Updates a WooCommerce payment gateway by id, changing only the fields you send: enabled state, title, description, or display order. Returns the updated gateway shape with secrets redacted. Requires the manage-WooCommerce capability.

Lists WooCommerce orders with their id, number, status, total, currency, date, and customer id, plus a total count. List rows are lean - no billing or shipping details. Requires the manage-WooCommerce capability.

Reads one WooCommerce order by id: line items, totals, status, dates, customer note, and the full customer billing address (including email and phone) and shipping address. Customer PII is returned in full under the Integrations security disclaimer. Requires the manage-WooCommerce capability.

Creates a WooCommerce order from optional status, customer id, billing, shipping, and line items. Returns the full order shape including PII under the Integrations security disclaimer. Requires the manage-WooCommerce capability.

Updates a WooCommerce order by id, changing only the fields you send. Requires the manage-WooCommerce capability.

Sets the status of a WooCommerce order by id. Accepts both the short form (e.g. "completed") and the wc-prefixed form (e.g. "wc-completed"). Requires the manage-WooCommerce capability.

Lists all notes on a WooCommerce order by order id. Returns each note's id, text, date, and whether it is customer-facing. Requires the manage-WooCommerce capability.

Adds a note to a WooCommerce order by order id. Optionally marks the note as customer-facing so it appears in the customer's account. Requires the manage-WooCommerce capability.

Lists all refunds on a WooCommerce order by order id. Returns each refund's id, amount, reason, and date. Requires the manage-WooCommerce capability.

Reads a single refund by refund id. Returns the refund amount, reason, and date. Reason text is returned verbatim under the Integrations security disclaimer. Requires the manage-WooCommerce capability.

Creates a refund on a WooCommerce order by order id. Accepts an amount, optional reason, and optional line-item breakdown. Reason text is returned verbatim under the Integrations security disclaimer. Requires the manage-WooCommerce capability.

Lists WooCommerce products with their id, name, SKU, price, stock status, status, categories, and featured flag, plus a total. Requires the manage-WooCommerce capability.

Reads one WooCommerce product by id, including its description, prices, stock, images, attributes, variation ids, and categories. Requires the manage-WooCommerce capability.

Creates a WooCommerce product from a name (required) plus optional type, status, description, prices, SKU, stock, categories, tags, images, and attributes. Requires the manage-WooCommerce capability.

Updates a WooCommerce product by id, changing only the fields you send. Requires the manage-WooCommerce capability.

Permanently deletes a WooCommerce product by id. This bypasses the Trash and cannot be undone. Requires the manage-WooCommerce capability.

Returns a sales summary for a date range: total sales, order count, net sales, and average order value. Defaults to the current calendar month. Requires the manage-WooCommerce capability.

Returns the best-selling products for a period (week, month, or year) ordered by quantity sold. Requires the manage-WooCommerce capability.

Returns order counts broken down by WooCommerce status (pending, processing, on-hold, completed, cancelled, refunded, failed) plus a total of active (non-trashed) orders. HPOS-aware. Requires the manage-WooCommerce capability.

Returns product counts broken down by post status (publish, draft, private, pending, trash) plus a total of active (non-trash) products. Requires the manage-WooCommerce capability.

Lists WooCommerce shipping zones with their id, name, and order. Requires the manage-WooCommerce capability.

Reads one WooCommerce shipping zone by id, including its name, order, and zone locations. Requires the manage-WooCommerce capability.

Creates a WooCommerce shipping zone from a name and optional order. Returns the full zone shape. Requires the manage-WooCommerce capability.

Updates a WooCommerce shipping zone by id, changing only the fields you send. An empty request body is a no-op success. Returns the full zone shape. Requires the manage-WooCommerce capability.

Lists the shipping methods configured in a WooCommerce shipping zone. Requires the manage-WooCommerce capability.

Reads one shipping method from a WooCommerce shipping zone by zone id and instance id. Requires the manage-WooCommerce capability.

Adds a shipping method to a WooCommerce shipping zone. Provide the zone id and method type (e.g. flat_rate, free_shipping, local_pickup). Returns the new method shape. Requires the manage-WooCommerce capability.

Updates a shipping method in a WooCommerce shipping zone by zone id and instance id, changing only the fields you send. Returns the updated method shape. Requires the manage-WooCommerce capability.

Lists all WooCommerce tax rates across every tax class, returning id, country, state, rate, name, priority, compound flag, shipping flag, order, and class slug for each. Requires the manage-WooCommerce capability.

Reads one WooCommerce tax rate by id, returning id, country, state, rate, name, priority, compound flag, shipping flag, order, and class slug. Requires the manage-WooCommerce capability.

Creates a WooCommerce tax rate. Required fields: rate (decimal string). Optional: country, state, name, priority, compound, shipping, order, class slug. Returns the full rate shape. Requires the manage-WooCommerce capability.

Updates a WooCommerce tax rate by id, changing only the fields you send. An empty body (only id) is a no-op success. Returns the updated rate shape. Requires the manage-WooCommerce capability.

Lists all WooCommerce tax classes including the Standard class, returning name and slug for each. Requires the manage-WooCommerce capability.

Creates a WooCommerce tax class from a name, with an optional slug. Returns the new class shape. Requires the manage-WooCommerce capability.

Lists a variable product's variations by parent product id, each with its id, parent id, SKU, price, stock status, and status, plus a total. Requires the manage-WooCommerce capability.

Reads one product variation by id, including its parent id, prices, stock, description, image, and its chosen attribute values. Requires the manage-WooCommerce capability.

Creates a variation under a variable product (parent product id required) from optional status, description, prices, SKU, stock, image, and attribute values. Requires the manage-WooCommerce capability.

Updates a product variation by id, changing only the fields you send. Requires the manage-WooCommerce capability.

Permanently deletes a product variation by id. This bypasses the Trash and cannot be undone. Requires the manage-WooCommerce capability.