API Command

wcpay api makes authenticated REST API requests to the selected WooCommerce/WooPayments store.

Curated read commands use reviewed WooPayments REST endpoints directly. The CLI authenticates with WooCommerce REST API consumer keys, so it intentionally avoids the WordPress Abilities API namespace.

Examples

wcpay api get /wc/v3/payments/accounts
wcpay api get /wc/v3/payments/settings
wcpay api get /wc/v3/payments/transactions page:=1 per_page:=25
wcpay api post /wc/v3/payments/refund order_id:=123 amount:=500 reason="CLI test"

Path normalization

These should be equivalent:

wcpay api get wc/v3/payments/accounts
wcpay api get /wc/v3/payments/accounts
wcpay api get /wp-json/wc/v3/payments/accounts

Inline fields

Initial syntax:

Form	Meaning
foo=bar	string value
foo:=123	JSON number
foo:=true	JSON boolean
foo:=null	JSON null

For GET/DELETE, fields become query parameters. For POST/PUT/PATCH, fields become a JSON body.

Future syntax candidates

Inspired by Notion CLI:

Form	Meaning
name==value	explicit query parameter
Header:Value	request header
path.to.key=value	nested body field
path[key][0]=value	nested body field with bracket notation

Safety

All non-read methods use the live-mode write guard. Use --dry-run to inspect a write request without sending it.

--dry-run still checks WooPayments mode before printing a write request. If the store is live, the command fails before resolving/sending the write.

Raw write requests are limited to reviewed WooPayments paths and /wc/v3/orders. For unusual maintenance work outside those paths, pass --allow-unsafe-path explicitly. Treat that flag as dangerous: it can send write requests to arbitrary WordPress/WooCommerce REST endpoints using the selected profile's credentials.

Current implementation notes

• HTTPS stores use Basic Auth with WooCommerce consumer key/secret.
• HTTP local stores use WooCommerce OAuth 1.0 query parameters with HMAC-SHA256.
• Requests time out after 30 seconds by default; override with WCPAY_TIMEOUT (seconds) or the global --timeout flag.
• Read requests (GET/HEAD/OPTIONS) are retried up to twice on 429/502/503/504 and transport failures; writes are never retried.
• Pass the global --verbose flag (or set WCPAY_DEBUG=1) to print redacted request/response lines to stderr.
• Authorization and OAuth signatures are redacted from dry-run output.
• For GET/DELETE, inline fields become query parameters.
• For POST/PUT/PATCH, inline fields become a JSON body.
• Raw writes outside reviewed paths require --allow-unsafe-path.