REST API

Intercessor exposes a REST API under:

/wp-json/intercessor/v1/

Endpoints

Method	Endpoint	Access
GET	/requests	Public; non-moderators receive approved public requests
GET	/requests/{id}	Public only for public requests
POST	/requests	Submission permission checks apply
POST	/requests/{id}/status	edit_prayers
GET	/requesters	edit_prayers
GET	/requests/{id}/history	Public for exposed request history
GET	/requests/{id}/notes	edit_prayers
POST	/requests/{id}/notes	edit_prayers
DELETE	/requests/{id}/notes/{nid}	edit_prayers

Listing requests

GET /requests accepts:

• per_page — default 10, minimum 1, maximum 100.
• page — default 1.
• status — default approved.

Non-moderators are forced to Approved status, and private requests are never exposed publicly.

Creating requests

POST /requests delegates to the same submission pipeline used by the front-end form. This means rate limiting, duplicate prevention, profanity filtering, requester creation, storage, and configured notifications remain consistent across submission methods.

Moderation

Status changes use POST /requests/{id}/status and require the edit_prayers capability.

Notes

Request notes can be listed, created, and deleted by users with edit_prayers. New notes include content and an is_private flag, which defaults to true.

WARNING

Do not assume that a public GET endpoint exposes all stored fields. The REST implementation explicitly protects non-public and private requests from unauthorized callers.