API Tab: Setting Up the Interface

Admin5 Min.Updated: October 2, 2026

A festival app, the city’s partner website, an info screen at the station – they can all read your program directly from your website. In the Settings → API tab you switch this interface on, define what it passes on and issue keys.

What the API is – and what it isn’t

The API only reads; nobody can change data through it. It has its own fixed data format: fields may be added but are never renamed or removed. An application that works today keeps working after plugin updates. When you change something in the calendar, applications see it with their next request – nothing needs to be exported or sent.

Setting up in six steps

1
Switch on
Tick “Enable public API” and save. When it is off, the addresses don’t exist at all (HTTP 404); the calendar itself is not affected.
2
Choose access
“API key required” (recommended) or “Public” for an open data feed.
3
Define the data scope
Decide whether descriptions, speakers, links or prices are included.
4
Create keys
One key per application or partner – copy it immediately, it is shown only this once.
5
Pass it on
Send the partner the key, the base address and the link to the machine-readable description /openapi.
6
Test
With “Test request” and the option “Send as an external application” you see exactly what the partner receives.

The basic settings

The “API” tab: status, base address, access, rate limit, cache and allowed origins – with the data scope below.

Setting	Default	Meaning
Status	off	Switches the public interface on or off.
Base address	–	Starts with `/wp-json/convention-schedule-planner/public/v1/`. “Copy” puts it on the clipboard; it is always correct, even with unusual permalink settings.
Access	API key required	Only applications with a valid key receive data. With “Public”, keys keep working and are counted separately.
Rate limit	120 requests per minute	Per key, or per IP address without a key. Excess requests receive HTTP 429 with a note on when to retry. 0 = unlimited.
Cache duration	300 seconds	How long finished responses are kept. Changes to the program discard the cache automatically at once. “Clear API cache now” forces it by hand.
Allowed origins (CORS)	empty = all	Only for websites that query the API with JavaScript directly in the browser. One address per line, e.g. `https://app.example.com`. Apps, servers and Postman are not affected.

Key required, but none created?

If “API key required” is selected and no key exists yet, the tab shows a notice. Until then only logged-in administrators receive data.

Data scope

Title, dates, venue, categories, image, short description, status and link are always included. In addition you choose:

Area	Default	What is included
Full description	on	The long description as HTML – always in the single view, in lists on request (`include=description`).
Speakers & participants	on	Names, roles and positions at the sessions plus the `/speakers` endpoints. When off, these endpoints are missing entirely.
Links & social media	on	Website, shop, social media links and the info pages of sessions and speakers.
Email addresses	off	Contact addresses from the links block, unencrypted. Only takes effect together with “Links & social media”. An API makes automatic harvesting easy – only switch it on if a partner really needs the addresses.
Prices & tickets	on	Price, price note and ticket link, including the one inherited from the main event.

What is never passed on

Favorite counters, drafts, password-protected entries and speakers marked “internal only”. If speaker names or contact links go to partners, mention this in your privacy policy and, where appropriate, in your agreements with the speakers.

API keys

Key management: create a new key at the top, below the list with limit, last use, requests and status.

1
Enter a name
E.g. “Festival app” or “City portal”. That way you can see later who is fetching data.
2
Own limit (optional)
A rate limit just for this key; empty = default.
3
“Create key”
The key starts with ecpk_ and appears exactly once. Only a fingerprint is stored – if it is lost, create a new one and revoke the old one.

The list shows each key’s name, creator, last characters, limit, creation date, last use, number of requests and status. Revoke rejects requests with this key immediately; all others keep working. A revoked key stays in the list: Unlock makes it valid again – the same key, the partner changes nothing, the request counts are kept. Delete removes it for good; the application then needs a new key. Each of the three actions asks for confirmation first.

Never in public JavaScript

A key in a website’s source code can be read by anyone. For widgets that run in your visitors’ browsers, choose “Public” access or let a server fetch the data.

Endpoints & test request

At the bottom of the tab: all endpoints with a short description, a curl example and the test request.

The table lists all addresses of the interface, followed by a ready-made curl example with real data from your website. With the test request you choose an endpoint, enter an ID and parameters if needed (e.g. per_page=5) and see the response right in the tab.

Test like a partner

Without the option “Send as an external application”, the request runs with your administrator login and needs no key. Switch it on and enter a key to see exactly what the third-party application receives – including error messages.

All addresses, filters, response fields and code examples for developers are under REST API; the plugin help in the back end contains the same guide with examples from your own data.

When something doesn’t work

Observation	Cause and fix
“rest_no_route” although the API is on	Save the API settings once more and compare the address with the base address shown.
An HTML page or 403 instead of JSON	A security plugin or firewall blocks the REST API for visitors who are not logged in. Allow the path `/wp-json/convention-schedule-planner/public/v1/` there.
CORS error in the browser console	The calling website is missing from “Allowed origins”. Add it or empty the list.
Changes don’t arrive	The API discards its cache with every change by itself. Check whether the application stores data itself or a caching plugin or CDN caches the `/wp-json/` addresses.
A key for one main event only?	Not possible yet. Every valid key sees all published sessions; the `parent` parameter only filters.