REST API Reference

Core Tables keeps its admin screens, blocks and table scripts on one REST API under /wp-json/core-tables/v1/. You can use the same routes from your own code.

2 routes are public. Everything else needs a logged-in user with the right capability, through a cookie with a nonce or an Application Password.

Public Routes

These need no login and only ever return the published revision’s public columns.

Method and route	Purpose
GET /public/datasets/{id}	Published rows
GET /public/datasets/{id}/export	The public CSV, as {csv}. It returns not found unless the published revision allows CSV downloads.

/public/datasets/{id} takes these parameters:

Parameter	Values	Default
search	Text up to 200 characters, matched anywhere in public text cells	none
filters[key]	An exact value for a public column, up to 2,000 bytes	none
sort	A public column key	source order
direction	asc or desc	asc
page	Page number	1
per_page	1 to 100	10
all_rows	Return every row instead of a page	off

curl "https://example.com/wp-json/core-tables/v1/public/datasets/12?search=pro&sort=price&direction=desc&per_page=20"

Trashed, deleted and unpublished datasets return not found here.

Authenticated Routes

“Edit access” means the edit_core_tables capability plus ownership of the dataset, or the manage_core_tables capability, on a dataset that isn’t in Trash.

Datasets

Method and route	Permission	Purpose
GET /dataset-browser	edit_posts, or edit_core_tables with editable=true	Paged list: page, per_page up to 100 (default 20), search, status (all, published, draft, trash), orderby (id, name)
GET /datasets	edit_posts, or edit_core_tables for editable or trash lists	Older list, first 100
POST /datasets	edit_core_tables	Create a dataset
GET /datasets/{id}	Edit access	Read the draft
PUT /datasets/{id}	Edit access	Save a draft, with expected_version
GET /datasets/{id}/access	edit_posts	Whether you can edit it
POST /datasets/{id}/publish	Edit access and publish_core_tables	Publish, with expected_version and revision_id
POST /datasets/{id}/unpublish	Edit access and publish_core_tables	Unpublish
GET /datasets/{id}/revisions	Edit access	Revision list, 20 per page
GET /datasets/{id}/revisions/{revision}	Edit access	One snapshot
GET /datasets/{id}/activity	Edit access	The last 50 events
POST /datasets/{id}/retention	manage_core_tables and edit access	Preview with confirm=false, or prune keeping keep (2 to 1,000, default 20)
POST /datasets/{id}/trash	Edit access	Move to Trash
POST /datasets/{id}/restore	Owner or administrator, dataset in Trash	Restore
DELETE /datasets/{id}/permanent	manage_core_tables, dataset in Trash	Delete for good, with confirmation set to DELETE id
GET /datasets/{id}/trash-export	export_core_tables, dataset in Trash	CSV of the draft
GET /datasets/{id}/export	Edit access and export_core_tables	format (csv, json, html, markdown) and public_only

Imports

Method and route	Permission	Purpose
POST /imports/preview	edit_core_tables	Parse a CSV, with csv and delimiter
POST /imports/convert	edit_core_tables	Convert content in format (csv, html, markdown, json), with first_row_header and delimiter
POST /convert/preview	edit_core_tables	Older HTML-only conversion, kept for clients built before 1.0
GET /imports/plugins	manage_core_tables	List tables in other table plugins
POST /imports/plugins	manage_core_tables	Import 1 table, with source and table

Google Sheets

Method and route	Permission	Purpose
GET /datasets/{id}/source	Edit access	Connection state and recent jobs
PUT /datasets/{id}/source	manage_core_tables	Save the connection and mapping
DELETE /datasets/{id}/source	manage_core_tables	Disconnect
POST /datasets/{id}/source/preview	manage_core_tables	Preview the range
POST /datasets/{id}/source/refresh	Edit access	Queue a refresh, with expected_version
POST /datasets/{id}/source/refresh-now	Edit access	Run a refresh now, with expected_version
POST /datasets/{id}/source/pause	manage_core_tables	Pause or resume, with paused
POST /datasets/{id}/source/jobs/{job}/cancel	Edit access	Cancel a job

Settings

Method and route	Permission	Purpose
GET /appearance	edit_posts	Site appearance and whether you can manage it
POST /appearance	manage_core_tables	Save appearance
GET and POST /ai	manage_core_tables	AI & MCP settings, the MCP endpoint and Site Agent status
GET /license	manage_core_tables	License status
POST /license/activate, /license/check, /license/disconnect	manage_core_tables	License actions

Saving Safely

Saves and publishes take the expected_version you last read. If someone saved in between, the request fails with stale_version and “This dataset changed in another editor. Reload before trying again.”

You can also send an Idempotency-Key header on POST /datasets, PUT /datasets/{id} and POST /datasets/{id}/publish. Use 16 to 128 letters, digits, _ or -. A retried request with the same key returns the first result instead of saving twice. Reusing a key with different content is refused.

curl -X POST "https://example.com/wp-json/core-tables/v1/datasets/12/publish" \
  -u "editor:application-password" \
  -H "Idempotency-Key: publish-plans-2026-10-26" \
  -H "Content-Type: application/json" \
  -d '{"expected_version": 4, "revision_id": 31}'

Take expected_version and the draft’s revision ID from a GET /datasets/{id} response just before you publish.

Responses and Errors

Every response is sent with Cache-Control: private, no-store. A request body can be up to 16 MB plus 64 KB.

HTTP status	Code	Meaning
422	invalid_dataset	A value, column or limit failed validation
409	stale_version	Someone saved the dataset after you read it
404	not_found	Missing, unpublished or trashed, or you can’t see it
413	too_large	Over the 16 MB limit
500	storage_error	The database write failed

AI tools can reach the same work through the commands in Build Tables with Site Agent. Actions you can hook into are in Hooks, Data, Privacy and Uninstall.