REST API

All endpoints are relative to ${FLEETWP_URL}/api/v1 and require a Bearer token (see Authentication). Responses are JSON.

Sites

Get a site

GET /api/v1/sites/{id}

Backups

List a site's backups

GET /api/v1/sites/{id}/backups

Each backup includes id, type, status, size_bytes, created_at, completed_at, and error.

Create a backup

POST /api/v1/sites/{id}/backups
Content-Type: application/json

{ "type": "full" }

type is one of full (default), db, or files. Requires the write scope.

Actions

Run a command against a site.

POST /api/v1/sites/{id}/actions
Content-Type: application/json

{ "action": "update", "plugins": ["akismet", "woocommerce"] }

`action`	Effect	Scope
`ping`	Signed liveness check of the connector	read
`update`	Apply updates (optionally limited to `plugins[]`)	write
`login`	Return a one-click admin login URL	write

Activity

GET /api/v1/activity?limit=50

Returns recent workspace activity. limit defaults to 50 (capped). Add site_id (or call GET /api/v1/sites/:id/activity) for one site.

Log activity

Record maintenance done outside FleetWP, by hand in wp-admin, over SSH, or by an agent working elsewhere, so it shows in the site's timeline and its maintenance reports. Requires the write scope.

POST /api/v1/sites/:id/activity

{
  "summary": "Cleared spam comments and optimized the database",
  "notes": "Removed 4,200 spam comments; ran OPTIMIZE on wp_options.",
  "category": "maintenance",
  "performed_at": "2026-10-01T14:30:00Z",
  "performed_by": "Mike",
  "internal": false
}

Field	Notes
`summary`	Required. One line, up to 200 characters. Shown in the timeline and reports.
`notes`	Optional detail, up to 2,000 characters. Never shown in client reports.
`category`	`maintenance` (default), `update`, `fix`, `security`, `performance`, `content`, `backup`, `other`
`performed_at`	When the work happened. Defaults to now; up to 180 days back.
`performed_by`	Who did it, useful when several people or agents share one token.
`internal`	`true` keeps the entry out of client reports.

Returns 201 with the created entry. Logging is a record, not a change to the site, so an agent with approval-only access writes it directly, but its entries are always saved as internal. An owner or admin reviews them on the Activity page and chooses Show in reports to include one in client reports.

Errors

Status	Meaning
`400`	Invalid payload
`401`	Missing or invalid token
`403`	Token lacks the required scope
`404`	Site not found in this workspace

Example

# Trigger a database backup, then poll the backups list
curl -s -X POST "$FLEETWP_URL/api/v1/sites/$SITE/backups" \
  -H "Authorization: Bearer $FLEETWP_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"type":"db"}'

curl -s "$FLEETWP_URL/api/v1/sites/$SITE/backups" \
  -H "Authorization: Bearer $FLEETWP_TOKEN"