REST API

WP-PFWorkflow exposes a REST surface under /wp-json/pfw-workflow/v1/ on YOUR WordPress install. The agent (WP-PFAgent) uses these endpoints as its primary tools. You can call them from any HTTP client.

Authentication

Cookie auth with X-WP-Nonce: <wp_create_nonce('wp_rest')> for browser calls. Application Password (WordPress core feature) for server-to-server calls.

Required capability for every endpoint:

• pfw_manage_workflows for create/update/delete
• pfw_view_workflows for read
• pfw_run_workflows for the /run endpoint