> ## Documentation Index > Fetch the complete documentation index at: https://docs.mainwp.com/llms.txt > Use this file to discover all available pages before exploring further. # Abilities API Overview > MainWP Dashboard 6.3 registers 70 abilities into WordPress Core's Abilities API framework for programmatic site management, Knowledge, and automation. The WordPress Abilities API is a **WordPress Core feature** (available in WordPress 6.9+) that provides a standardized registry for capabilities across the WordPress ecosystem. Any plugin can register discrete actions ("abilities") with defined input/output schemas, making functionality discoverable by external systems. MainWP Dashboard 6.3 registers 70 abilities into this framework across six categories. This integration enables AI agents, automation platforms, and external tools to discover what MainWP can do and execute those capabilities through a consistent interface. Earlier Dashboard versions expose a smaller catalog. ## What You'll Learn * How the Abilities API enables discovery of MainWP capabilities * Available ability categories and endpoints * How to execute abilities and handle responses * Error handling for AI agent integrations WordPress Developer Blog Full framework documentation Source and issues *** ## How It Works The Abilities API adds a **discovery layer** to WordPress. AI agents and automation tools query `/wp-abilities/v1/abilities` to see all available actions, their input schemas, output schemas, and behavioral annotations. This enables dynamic discovery of what operations are possible and automated parameter validation. Connect Claude, VS Code Copilot, and Cursor to your MainWP Dashboard through the Model Context Protocol. The MCP Server exposes MainWP abilities as tools that AI assistants can call directly. *** ## Prerequisites * WordPress 6.9 or later * MainWP Dashboard 6.0 or later * WordPress user with `manage_options` capability * A WordPress Application Password or another native WordPress REST authentication method *** ## Base URL All Abilities API endpoints use the WordPress Abilities namespace: ``` https://your-dashboard.com/wp-json/wp-abilities/v1/ ``` *** ## Authentication The Abilities API accepts any WordPress REST API authentication method. ### MainWP API Keys MainWP REST API keys authenticate MainWP REST namespaces such as `mainwp/v2`. They do not authenticate WordPress Abilities routes under `wp-abilities/v1`, even when the ability name starts with `mainwp/`. Use an Application Password for the examples on these pages. ### Application Passwords Create an Application Password in **Dashboard > API Access > Application Passwords**: ```bash theme={null} curl -u "USERNAME:APPLICATION_PASSWORD" \ "https://your-dashboard.com/wp-json/wp-abilities/v1/abilities" ``` For full setup steps, see [Application Passwords](/api-reference/rest-api/application-passwords). Dashboard 6.3 also provides inline credential creation under **MainWP > AI > MainWP MCP** and **MainWP > AI > MainWP Control**. See [AI Menu](/dashboard/overview/mainwp-ai). ### Site Access and Operation Permissions Authentication does not override the user's site access or Team Control permissions. Dashboard 6.3 checks the requested sites and the operation's required rights. For example, plugin updates need **Update Plugins**, site deletion needs **Delete Sites**, client changes need **Manage Clients**, and tag changes need **Manage Groups**. Multi-type update calls need the rights for each selected update type. Background jobs recheck their owner's permissions and site access when they execute. A queued job is not a guarantee that its originally selected sites or actions will still be permitted. Add-on abilities can require their own extension and operation permissions; see each Add-on's reference. *** ## Discovery Endpoints These endpoints let you explore what abilities are available. ### List All Abilities ```http theme={null} GET /wp-json/wp-abilities/v1/abilities ``` Returns registered abilities with pagination. | Parameter | Type | Default | Description | | - | - | - | - | | `page` | integer | 1 | Page number | | `per_page` | integer | 50 | Items per page (max 100) | | `category` | string | — | Filter by category slug | ```bash theme={null} curl -u "admin:xxxx" \ "https://your-dashboard.com/wp-json/wp-abilities/v1/abilities?category=mainwp-sites" ``` ### Get Single Ability ```http theme={null} GET /wp-json/wp-abilities/v1/abilities/{name} ``` Returns full details for a specific ability including input/output schemas. ```bash theme={null} curl -u "admin:xxxx" \ "https://your-dashboard.com/wp-json/wp-abilities/v1/abilities/mainwp/list-sites-v1" ``` ### List Categories ```http theme={null} GET /wp-json/wp-abilities/v1/categories ``` MainWP registers these categories: | Category | Abilities | Description | | - | - | - | | `mainwp-sites` | 30 | Site management and monitoring | | `mainwp-updates` | 14 | Update detection, previewed execution, and site hold removal | | `mainwp-clients` | 11 | Client management | | `mainwp-tags` | 7 | Tag/group management | | `mainwp-batch` | 1 | Batch operation monitoring | | `mainwp-knowledge` | 7 | Agency, client, and site Knowledge reads and record management | 30 abilities for site management 14 abilities for update management 11 abilities for client management 7 abilities for tag management 7 abilities for saved context, Skills, and Memory *** ## Add-on Abilities MainWP Add-ons can register additional abilities alongside the 70 Dashboard abilities in version 6.3. These appear only when the relevant Add-on is active. | Add-on | Category | Abilities | Reference | | - | - | - | - | | Advanced Uptime Monitor with Abilities support | `mainwp-advanced-uptime-monitor` | 7 | [Advanced Uptime Monitor Abilities](/api-reference/abilities-api/advanced-uptime-monitor) | | Cache Control 5.3 or later | `mainwp-cache-control` | 8 | [Cache Control Abilities](/api-reference/abilities-api/cache-control) | | Clone 5.1 or later | `mainwp-clone` | 3 | [Clone Abilities](/api-reference/abilities-api/clone) | | Custom Dashboard 5.2 or later | `mainwp-custom-dashboard` | 4 | [Custom Dashboard Abilities](/api-reference/abilities-api/custom-dashboard) | | Google Search Console 6.3 or later | `mainwp-google-search-console` | 10 | [Google Search Console Abilities](/api-reference/abilities-api/google-search-console) | | Matomo 5.2 or later | `mainwp-matomo` | 12 | [Matomo Abilities](/api-reference/abilities-api/matomo) | | WooCommerce Shortcuts 5.1 or later | `mainwp-woocommerce-shortcuts` | 1 | [WooCommerce Shortcuts Abilities](/api-reference/abilities-api/woocommerce-shortcuts) | These Add-ons use the `mainwp/` namespace. Cache Control provides cache status reads, policy changes, Cloudflare credential validation, and single-site cache purging. Clone provides stored policy status, global enablement, and per-site participation settings. Custom Dashboard provides snippet metadata, PHP validation, and previewed snippet replacements and removals. Google Search Console provides connection and property reads, site mappings, cached performance summaries, refresh settings, and background refresh jobs. Matomo provides connection management, previewed site assignments, cached analytics and trends, and scheduled refreshes with status and cancellation. WooCommerce Shortcuts provides a read-only cached WooCommerce status check for an authorized site. Find their references in the **Add-on Abilities** navigation group. Advanced Uptime Monitor provides cached monitors and events, live uptime summaries, and monitor creation, state changes, deletion, and inventory synchronization. These abilities require the upcoming Abilities-enabled release; they are absent from the initial 5.4 package. Check the [uptime reference](/api-reference/abilities-api/advanced-uptime-monitor) for availability and provider limits. UpdraftPlus 5.2 includes database and runtime groundwork for future backup abilities, but those abilities are disabled by default until compatible MainWP Child support is available. Activating the add-on does not make them available through the Abilities API or MainWP AI Assistant. Use the [UpdraftPlus Dashboard workflows](/add-ons/backups/updraftplus-extension#abilities-api-availability) in this release. Updating MainWP Child for 6.3 does not enable these backup abilities: its UpdraftPlus protocol still advertises no executable provider operations. *** ## Executing Abilities ### Endpoint ```http theme={null} GET|POST|DELETE /wp-json/wp-abilities/v1/abilities/{name}/run ``` ### HTTP Methods Choose the method from the ability's `meta.annotations`: * **GET** - Read-only abilities (`readonly: true`), including those that require input. * **DELETE** - Non-read-only abilities with both `destructive: true` and `idempotent: true`. * **POST** - All other write abilities, including destructive abilities marked `idempotent: false`. For example, `mainwp/delete-tag-v1` uses DELETE, while `mainwp/delete-site-v1` and `mainwp/delete-client-v1` use POST. These methods follow [WordPress Abilities method validation](https://developer.wordpress.org/reference/classes/wp_rest_abilities_v1_run_controller/validate_request_method/); using the wrong method returns `rest_ability_invalid_method` with HTTP 405. ### Input Handling MainWP Dashboard 6.2 supports the following input formats for `mainwp/*` ability run routes. **GET requests**: Omit input only when the ability's schema supplies suitable defaults. To provide filters or required values, send the input object as JSON in the `input_json` query parameter. Use `--data-urlencode` with `curl -G` to encode it correctly: ```bash theme={null} curl -G -u "admin:xxxx" \ --data-urlencode 'input_json={"site_id_or_domain":1,"include_stats":true}' \ "https://your-dashboard.com/wp-json/wp-abilities/v1/abilities/mainwp/get-site-v1/run" ``` `input_json` preserves JSON types such as booleans, arrays, and `null` for schema validation. The JSON value must be an object and must not exceed 8 KiB (8,192 bytes). Do not send both `input` and `input_json`. Legacy bracket-style query parameters remain supported, but a JSON string in the plain `input` parameter is not decoded by this adapter. Keep credentials out of query strings. **POST requests**: Pass an `input` object in the JSON body: ```bash theme={null} curl -X POST -u "admin:xxxx" \ -H "Content-Type: application/json" \ -d '{"input":{"site_ids_or_domains":[1]}}' \ "https://your-dashboard.com/wp-json/wp-abilities/v1/abilities/mainwp/sync-sites-v1/run" ``` **DELETE requests**: Use an `application/json` body containing only an `input` object. This keeps operation inputs out of the URL. For example, preview a tag deletion: ```bash theme={null} curl -X DELETE -u "admin:xxxx" \ -H "Content-Type: application/json" \ -d '{"input":{"tag_id":1,"dry_run":true}}' \ "https://your-dashboard.com/wp-json/wp-abilities/v1/abilities/mainwp/delete-tag-v1/run" ``` After reviewing the preview, execute with `confirm: true` and `dry_run: false`. The DELETE body must not exceed 1 MiB (1,048,576 bytes). Do not combine a body with `input` or `input_json` query parameters. Existing bracket-style `input` query parameters remain supported when no body is sent, but the JSON body is preferred. `input_json` is a GET-only parameter. Malformed JSON, conflicting input sources, unsupported DELETE body formats, and input exceeding the transport limits return `mainwp_abilities_invalid_input_transport` with HTTP 400. Valid transport still has to pass the individual ability's input schema and permission checks. *** ## Response Format ### Success Abilities return their defined output schema directly: ```json theme={null} { "items": [ { "id": 1, "url": "https://example.com", "name": "My Site", "status": "connected" } ], "page": 1, "per_page": 20, "total": 150 } ``` ### Errors Error responses follow WordPress REST API conventions: ```json theme={null} { "code": "ability_invalid_input", "message": "Invalid parameter: site_id_or_domain is required", "data": { "status": 400 } } ``` *** ## Ability Annotations Each ability includes metadata describing its behavior: | Annotation | Type | Description | | - | - | - | | `readonly` | boolean | True if ability only reads data | | `destructive` | boolean | True for protected changes, including deletion and 6.3 update execution or hold removal | | `idempotent` | boolean | True if repeated calls have no additional effect | | `instructions` | string | Custom usage guidance | These annotations help AI agents make informed decisions about which abilities to call and in what order. *** ## Error Reference ### Abilities API Errors | Code | HTTP | Description | | - | - | - | | `ability_invalid_input` | 400 | Input fails JSON Schema validation | | `ability_missing_input_schema` | 400 | Required input not provided | | `ability_invalid_permissions` | 403 | Permission callback returned false | | `ability_invalid_output` | 500 | Output fails validation | | `rest_ability_not_found` | 404 | Ability not registered | | `rest_ability_invalid_method` | 405 | Wrong HTTP method for ability type | ### MainWP-Specific Errors | Code | HTTP | Description | | - | - | - | | `mainwp_abilities_invalid_input_transport` | 400 | Invalid JSON input format, conflicting input sources, or transport size limit exceeded | | `mainwp_site_not_found` | 404 | Site ID or domain not found | | `mainwp_client_not_found` | 404 | Client ID or email not found | | `mainwp_tag_not_found` | 404 | Tag ID not found | | `mainwp_job_not_found` | 404 | Batch job expired or not found | | `mainwp_confirmation_required` | 400 | Destructive operation missing `confirm: true` | | `mainwp_site_offline` | 503 | Site unreachable | | `mainwp_module_not_available` | 501 | Required module not active | *** ## Feature-Gated Abilities Some abilities require optional MainWP modules: | Module | Required For | | - | - | | Cost Tracker | `get-site-costs-v1`, `get-client-costs-v1` | | Logs | `get-site-changes-v1` | If the required module is inactive, these abilities return a `mainwp_module_not_available` error. *** ## Related Resources * [MCP Server](/mcp-server/overview) - Connect AI assistants to MainWP * [Sites Abilities](/api-reference/abilities-api/sites) - Site management abilities * [REST API Overview](/api-reference/rest-api/overview) - Alternative REST API * [Batch Operations](/api-reference/abilities-api/batch-operations) - Monitor batch jobs This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.