Contents
REST API - Plugixa Exam
Everything the admin app does, it does over REST, under the namespace
plugixa-exam/v1. So does the exam runner.
That is worth knowing for two reasons: anything the interface can do is scriptable, and every permission the interface enforces is enforced at the endpoint rather than in the page.
Authentication
| Caller | How |
|---|---|
| The admin app | The logged-in cookie plus a nonce, the normal WordPress way |
| The runner | The same, including for a guest, whose signed cookie identifies them |
| A script or another system | A scoped bearer token PRO |
For anything outside a browser, use API tokens. They carry per-scope permissions and default to deny.
Send the nonce. A browser request that omits it reaches the routes looking anonymous, fails the ownership check against the attempt, and comes back as a permission error rather than an authentication one. That is the confusing failure mode worth recognising.
Shape
Routes follow the resources the admin has: exams, questions, subjects, tags, attempts, roles, settings, notifications, and the premium modules’ own. Each module registers its own, so the surface grows with what is installed and a capability switched off in the App Manager takes its endpoints with it.
plugixa_exam_register_rest_routes fires when routes are being registered, which
is where to add your own alongside them.
Filtering what comes back
Several filters let you change payloads without touching the routes:
| Filter | Changes |
|---|---|
plugixa_exam_exam_output |
An exam as returned |
plugixa_exam_question_output |
A single question |
plugixa_exam_question_list_output |
A list of questions |
plugixa_exam_filter_output |
The filter options offered |
See Hooks for the full set.
A caution about load order
The plugin learned this the hard way and it is worth repeating for anybody extending it: do not ask WordPress for its own REST URL during plugin load. That answer depends on rewrite rules WordPress has not built yet at that point. On a premium site running WooCommerce it produced a blank front end on every page, fixed in 1.0.0. Resolve REST URLs when you need them, not at boot.
Troubleshooting
| Symptom | Usual cause |
|---|---|
| 401 or 403 from the browser | The nonce is missing or stale. Reload the admin. |
| 404 on a route that should exist | Its capability is off in the App Manager, or the module is not installed. |
| A token works for reads and not writes | Scopes default to deny. Grant the write scope explicitly. |
| Everything works signed in, nothing works from a script | You are relying on the cookie. Use a bearer token. |
What to do next
- Get a token in API Tokens PRO.
- Change behaviour in PHP instead: Hooks.
- Have events pushed to you rather than polling: Webhooks PRO.