Apply Changes - Plugixa Advanced User Role Editor for WordPress

POST /plugixa-aure/v1/changes/apply

Save a set of changes to roles and people, or refuse all of it. Send the body you previewed with Preview Changes, with the key of every warning that has confirm: true copied into acknowledged.

Needs plugixa_aure_edit_roles or plugixa_aure_edit_users to get in. The body is then checked part by part: the roles part needs plugixa_aure_edit_roles, and the users part needs plugixa_aure_edit_users and the Users feature switched on.

Note. The confirmation is checked on the server, so a script cannot skip it by not showing a dialog.

Request

POST https://your-site.example/wp-json/plugixa-aure/v1/changes/apply

Request body

Content type: application/json

Field	Type	Required	Description
`roles`	`object`	No	Role slug to the role’s whole capability map: `true` grants, `false` blocks. A capability the role holds now and that is missing from the map is taken away.
`users`	`object`	No	Account id to an object with `roles` (the whole list, in order) and/or `capabilities` (the account’s whole own map). A key you leave out keeps its current value.
`versions`	`object`	No	`role:<slug>` or `user:<id>` to the `version` you read from List Roles or Get User. A mismatch means someone changed it since, and blocks the set.
`acknowledged`	`array`	No	The `key` of each warning you confirm.

Inside the maps, values that are not real JSON booleans are dropped rather than read as a block. Roles and people that the body would not actually change are left out of the result. Administrator can only be changed while editing it is switched on in Settings. One apply is one restore point, taken before anything is written.

{
  "roles": {
    "editor": {
      "read": true,
      "edit_posts": true,
      "publish_posts": true,
      "install_plugins": true
    }
  },
  "users": {
    "12": {
      "roles": [
        "author",
        "editor"
      ],
      "capabilities": {
        "switch_themes": true
      }
    }
  },
  "versions": {
    "role:editor": "3f9c2a71b0de",
    "user:12": "a41d07c95e22"
  },
  "acknowledged": [
    "role:editor:install_plugins"
  ]
}

Responses

`200` OK. Everything was saved.

{
  "success": true,
  "data": {
    "snapshot": 42,
    "totals": {
      "changes": 3,
      "people": 5
    }
  }
}

Field	Type	Meaning
`data.snapshot`	`integer`	The restore point taken before the save. `0` when the body changed nothing
`data.totals`	`object`	`changes` and `people`, as in the preview

Errors

Status	Code	When
`422`	`plugixa_aure_unacknowledged`	A warning with `confirm: true` is missing from `acknowledged`.
`409`	`plugixa_aure_changed_elsewhere`	A `version` you sent no longer matches.
`403`	`plugixa_aure_forbidden`	The body has a part you may not change, or a `users` part while the Users feature is off.
`403`	`plugixa_aure_administrator_locked`	The body changes Administrator while editing it is switched off in Settings.
`404`	`plugixa_aure_unknown_role`	A role slug does not exist.
`404`	`plugixa_aure_unknown_user`	No account with that id.
`422`	`plugixa_aure_no_roles`	An account would be left with no role.
`409`	`plugixa_aure_cap_is_role`	An account capability has the name of a role it holds.
`403`	`plugixa_aure_user_not_editable`	The account holds a role with capabilities you do not hold yourself.
`403`	`plugixa_aure_cannot_grant`	The change grants, or lifts a block on, a capability you do not hold yourself.
`403`	`plugixa_aure_cannot_revoke`	The change takes away, or blocks, a capability you do not hold yourself.
`409`	`plugixa_aure_last_administrator`	The account is the only administrator and would lose the role (single site only).
`409`	`plugixa_aure_self_lockout`	The change would remove your own access to the editor.

Plus the errors every endpoint can return.

Examples

curl -s -X POST "https://your-site.example/wp-json/plugixa-aure/v1/changes/apply" \
  -u "admin:$WP_APP_PASSWORD" \
  -H "Content-Type: application/json" \
  -d '{"roles":{"editor":{"read":true,"edit_posts":true,"publish_posts":true,"install_plugins":true}},"users":{"12":{"roles":["author","editor"],"capabilities":{"switch_themes":true}}},"versions":{"role:editor":"3f9c2a71b0de","user:12":"a41d07c95e22"},"acknowledged":["role:editor:install_plugins"]}'

<?php
$ch = curl_init('https://your-site.example/wp-json/plugixa-aure/v1/changes/apply');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST  => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_USERPWD        => 'admin:' . getenv('WP_APP_PASSWORD'),
    CURLOPT_HTTPHEADER     => ['Content-Type: application/json'],
    CURLOPT_POSTFIELDS     => json_encode([
        'roles'        => [
            'editor' => [
                'read'            => true,
                'edit_posts'      => true,
                'publish_posts'   => true,
                'install_plugins' => true,
            ],
        ],
        'users'        => [
            '12' => [
                'roles'        => ['author', 'editor'],
                'capabilities' => [
                    'switch_themes' => true,
                ],
            ],
        ],
        'versions'     => [
            'role:editor' => '3f9c2a71b0de',
            'user:12'     => 'a41d07c95e22',
        ],
        'acknowledged' => ['role:editor:install_plugins'],
    ]),
]);
$response = json_decode(curl_exec($ch), true);
curl_close($ch);

const response = await fetch('https://your-site.example/wp-json/plugixa-aure/v1/changes/apply', {
  method: 'POST',
  headers: {
    'Authorization': 'Basic ' + btoa(`admin:${process.env.WP_APP_PASSWORD}`),
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({ roles: { editor: { read: true, edit_posts: true, publish_posts: true, install_plugins: true } }, users: { '12': { roles: ['author', 'editor'], capabilities: { switch_themes: true } } }, versions: { 'role:editor': '3f9c2a71b0de', 'user:12': 'a41d07c95e22' }, acknowledged: ['role:editor:install_plugins'] }),
});
const { data } = await response.json();