Skip to main content
The SandyWP HTTP API is available at https://app.sandywp.com. The generated endpoint pages in this group are the complete supported customer API contract, rather than a list of every route hosted by the application.

​
Authentication

Use a personal API key as a bearer token for normal automation. Create, label, and revoke keys with the account token endpoints or through the dashboard and CLI.
Scoped OAuth tokens are intentionally narrower. They can call GET /api/account/me and the Imports family only, with import:read or import:write as appropriate; the other generated REST operations reject them. See OAuth connector flow for public-client registration and PKCE exchange guidance.

​
Requests, async work, and errors

Send JSON on standard write requests with Content-Type: application/json. Archive chunks use application/octet-stream; Blueprint and plugin ZIP uploads use multipart/form-data where the endpoint says so. Provisioning, imports, deployments, snapshots, and Blueprint runs are asynchronous. A response can include a job or run record, or a resource in a non-terminal state such as creating, building, pending, or running; poll the documented GET endpoint until it settles. Errors use a JSON envelope. Check error.code for programmatic handling and treat message as display text.

​
Included API families

The OpenAPI generator covers Templates, Sites and their tools, Blueprints, Imports, Workspaces, account identity/usage/tokens/SSH keys, and the OAuth registration and token-exchange contracts. The focused pages below add workflow guidance to the generated endpoint details.

Blueprint workflows

Validate, save, run, and bake reviewable WordPress build recipes.

Import workflows

Clone a live site or push a local WordPress archive.

Workspace workflows

Select workspaces and manage members and roles.

OAuth connector flow

Register a public client and exchange a PKCE authorization code.

​
Exclusions ledger

These hosted routes are intentionally outside the customer developer contract. They are browser backends, provider callbacks, public launch handlers, or operations interfaces—not undocumented alternatives to the generated endpoints.
The published mintlify-docs/openapi.yaml is intentionally byte-for-byte equal to the repository-root openapi.yaml. Automated checks reject drift between them.