List Orphan Capabilities - Plugixa Advanced User Role Editor

GET /plugixa-aure/v1/capabilities/orphans

Capabilities at least one role still holds although nothing on the site declares them: usually left behind by a plugin that was removed.

Needs the View permission: the signed-in user must hold plugixa_aure_view or any other of the editor’s own capabilities (plugixa_aure_edit_roles, plugixa_aure_edit_users, plugixa_aure_manage_settings).

Request

GET https://your-site.example/wp-json/plugixa-aure/v1/capabilities/orphans

Responses

200 OK. data is the list.

{
  "success": true,
  "data": [
    {
      "cap": "manage_old_forms",
      "human": "Manage old forms",
      "source": "orphan",
      "owner": "",
      "group": "orphan",
      "since": "",
      "deprecated": false,
      "severity": "none",
      "explain": "",
      "grantable": true,
      "rewrites_to": [],
      "active": true,
      "claim": [],
      "roles": [
        "editor"
      ],
      "likely_owner": "",
      "likely_active": false
    }
  ]
}

Each entry has the fields of List Capabilities, with source always orphan. Check likely_owner before cleaning up: when it names an installed plugin, the capability is probably still in use and Remove Capability refuses it.

Errors

Plus the errors every endpoint can return.

Examples

curl -s "https://your-site.example/wp-json/plugixa-aure/v1/capabilities/orphans" \
  -u "admin:$WP_APP_PASSWORD"

<?php
$ch = curl_init('https://your-site.example/wp-json/plugixa-aure/v1/capabilities/orphans');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_USERPWD        => 'admin:' . getenv('WP_APP_PASSWORD'),
]);
$response = json_decode(curl_exec($ch), true);
curl_close($ch);

const response = await fetch('https://your-site.example/wp-json/plugixa-aure/v1/capabilities/orphans', {
  headers: {
    'Authorization': 'Basic ' + btoa(`admin:${process.env.WP_APP_PASSWORD}`),
  },
});
const { data } = await response.json();