Contents
On this page

List Capabilities - Plugixa Advanced User Role Editor

GET /plugixa-aure/v1/capabilities

Every capability the site knows about: WordPress’s own, those declared by post types and taxonomies, those other plugins claim, those you added by name, and leftovers that only a role still holds. Sorted by name.

Needs the View permission: the signed-in user must hold plugixa_aure_view or any other of the editor’s own capabilities (plugixa_aure_edit_roles, plugixa_aure_edit_users, plugixa_aure_manage_settings).

Request

GET https://your-site.example/wp-json/plugixa-aure/v1/capabilities

Responses

200 OK. data is the list.

{
  "success": true,
  "data": [
    {
      "cap": "install_plugins",
      "human": "Install plugins",
      "source": "core",
      "owner": "WordPress",
      "group": "plugins",
      "since": "2.8",
      "deprecated": false,
      "severity": "critical",
      "explain": "Can upload and install any plugin, including one that grants itself administrator access.",
      "grantable": true,
      "rewrites_to": [],
      "active": true,
      "claim": [],
      "roles": [
        "administrator"
      ],
      "likely_owner": "",
      "likely_active": false
    },
    {
      "cap": "manage_old_forms",
      "human": "Manage old forms",
      "source": "orphan",
      "owner": "",
      "group": "orphan",
      "since": "",
      "deprecated": false,
      "severity": "none",
      "explain": "",
      "grantable": true,
      "rewrites_to": [],
      "active": true,
      "claim": [],
      "roles": [
        "editor"
      ],
      "likely_owner": "",
      "likely_active": false
    }
  ]
}
Field Type Meaning
data[].cap string The capability
data[].human string The name made readable
data[].source string core, post_type, taxonomy, claimed (another plugin declares it), custom (added with Add Capability) or orphan (nothing declares it)
data[].owner string WordPress, the post type or taxonomy label, or the claiming plugin. Empty for custom and orphan
data[].group string For WordPress capabilities their area (posts, plugins, …); otherwise post_type, taxonomy, plugin, custom or orphan
data[].since string WordPress version that introduced it. Empty when not a WordPress capability
data[].deprecated boolean A WordPress capability no longer used
data[].severity string critical, high, medium or none
data[].explain string What a holder can do, for the risky ones. Often empty
data[].grantable boolean false for a meta capability or alias that no role can usefully hold
data[].rewrites_to array For an alias, the capabilities WordPress checks instead
data[].active boolean false when the site currently switches the capability off, so granting it does nothing today
data[].claim array|object The label and description a claiming plugin supplied. An empty list when there are none
data[].roles array Slugs of the roles that grant it
data[].likely_owner string For an orphan, the installed plugin it probably belongs to. Empty when none
data[].likely_active boolean Whether that plugin is active

Errors

Plus the errors every endpoint can return.

Examples

curl -s "https://your-site.example/wp-json/plugixa-aure/v1/capabilities" \
  -u "admin:$WP_APP_PASSWORD"

<?php
$ch = curl_init('https://your-site.example/wp-json/plugixa-aure/v1/capabilities');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_USERPWD        => 'admin:' . getenv('WP_APP_PASSWORD'),
]);
$response = json_decode(curl_exec($ch), true);
curl_close($ch);

const response = await fetch('https://your-site.example/wp-json/plugixa-aure/v1/capabilities', {
  headers: {
    'Authorization': 'Basic ' + btoa(`admin:${process.env.WP_APP_PASSWORD}`),
  },
});
const { data } = await response.json();

Quick Links

Share