Every Payment Page route lives in the payment-page/v1 namespace, so the full URL is /wp-json/payment-page/v1/<route>.
Access rules#
| Access | How it is checked |
|---|---|
| Admin | A logged-in user with the payment_page_settings capability, which Payment Page gives to the Administrator role. Any WordPress REST authentication works (cookie with a wp_rest nonce, or an application password). |
| Signed checkout | No login. The request must carry the form's signed tokens. After the first call it must also carry the payment ID and the HMAC-SHA256 secret returned for that payment. Rate limits apply per IP address and per payment. |
| Webhook | No login. Stripe requests must pass the Stripe-Signature check against the mode's signing secret. PayPal requests must include all five PAYPAL-* transmission headers and pass PayPal's signature verification for the mode's Webhook ID. |
| Open | No login. Returns nothing private. |
Admin routes#
Dashboard and form builder#
| Method | Route | Purpose |
|---|---|---|
GET |
/administration/dashboard |
Data for the Payment Page dashboard: gateway status per mode, Quick Setup steps and the template list. |
POST |
/administration/dismiss-notification |
Dismisses the latest admin notification for the current user. |
GET |
/administration/template-list |
Page templates available to import from the Payment Page template site, with whether the current plan can install each one. |
POST |
/administration/set-quick-setup-skip |
Skips Quick Setup (status=1) or shows it again (status=0). |
POST |
/administration/import-template |
Imports a template by id. A negative ID is a template bundled with Payment Page; a positive ID is fetched from the template site. |
GET |
/administration/payment-forms/{id}/builder-data |
Field groups and saved values for the form builder. |
| any | /administration/payment-forms/{id}/live-preview |
Renders the form as HTML for the builder preview, with any unsaved payment_page_settings applied. |
POST |
/administration/payment-forms/{id}/test-email |
Sends sample admin and payer confirmation emails using the form's saved settings. Also requires permission to edit that form. |
Payment gateways#
| Method | Route | Purpose |
|---|---|---|
GET |
/payment-gateway/connect |
Starts connecting a gateway (payment_gateway, is_live). For Stripe it returns the Stripe Connect onboarding URL. |
GET |
/payment-gateway/connect-callback |
Return URL for Stripe Connect onboarding. It has no REST nonce, so it checks the administrator's WordPress login cookie and a single-use state that the same administrator started within the last 10 minutes. Then it saves the account keys for that mode. |
POST |
/payment-gateway/disconnect |
Removes a gateway's credentials for one mode. |
POST |
/payment-gateway/set-mode |
Switches a gateway between test and live. |
POST |
/payment-gateway/set-payment-methods |
Saves the enabled payment methods for a gateway. |
POST |
/payment-gateway/save-settings |
Saves PayPal credentials for one mode. |
POST |
/payment-gateway/save-webhook-settings |
Saves the webhook signing secret (Stripe) or Webhook ID (PayPal) for one mode. |
POST |
/payment-gateway/save-payment-method-settings |
Saves the settings of a payment method that has its own settings fields. |
Elementor install#
Both routes accept only identifier=elementor. They let Quick Setup install Elementor and are not a general plugin installer.
| Method | Route | Purpose |
|---|---|---|
POST |
/plugin/install |
Installs Elementor from WordPress.org. |
POST |
/plugin/activate |
Activates Elementor. |
Feature updates#
| Method | Route | Purpose |
|---|---|---|
GET |
/tagging/area/{slug} |
Details of a feature area shown in the admin, read from the Payment Page features service. |
POST |
/tagging/apply |
Sends an administrator's first_name, last_name, email_address and chosen tags for an area_slug to the Payment Page features service. |
Checkout routes (signed checkout)#
The payment form calls these in order: sync the payment details, create the provider payment, then complete it.
| Method | Route | Purpose |
|---|---|---|
POST |
/payment/sync-details |
Creates the local payment record for a checkout attempt, or updates it before it is paid. Returns the payment id and its secret. Updates send _current_id and _current_secret. New records are limited to 12 per minute per IP address. |
POST |
/stripe/payment-intent-or-setup |
Creates the Stripe PaymentIntent (one-time payment) or SetupIntent (subscription) for a synced payment. |
POST |
/stripe/checkout |
Completes a Stripe checkout after the browser confirms it (stripe_payment_intent_or_setup_id): settles the one-time charge or starts the subscription. |
POST |
/stripe/upsell-charge |
Charges a one-click post-purchase upsell to the card used for a completed one-time card payment. See Upsell charge. |
POST |
/payment/status |
Read-only status of a payment attempt. See Payment status. |
POST |
/paypal/order |
Creates, or reuses, the PayPal order for a synced one-time payment. |
POST |
/paypal/order/capture |
Captures the PayPal order (order_id), checks the capture against the stored payment, then records the payment. |
Every Stripe and PayPal route above (except /payment/status) allows 6 calls per minute per payment and 24 per minute per IP address. Requests over the limit get HTTP 429.
On the Free plan, Stripe payments are created on your connected account through the Payment Page API (api.paymentpageplugin.com), which adds the 2% Payment Page platform fee. With Pro, Payment Page creates them directly with Stripe.
Upsell charge#
POST /stripe/upsell-charge charges the offer configured on the form to the same customer and card as the original payment. It works only for a completed one-time card payment, and each offer can be charged once per original payment.
| Parameter | Value |
|---|---|
post_id |
The form ID. |
payment_id, payment_secret |
The original payment's ID and secret. |
pricing_token |
The form's signed pricing token that the original payment used. |
upsell_index |
Which configured offer to charge. |
finalize_payment_intent_id |
Only on the second call, after the buyer authenticates the card. |
Responses:
{"status": "ok"}when the charge succeeded or is processing.{"requires_action": true, "payment_intent_id": "...", "payment_intent_secret": "..."}when the card needs authentication. The form completes it with Stripe.js, then calls the route again withfinalize_payment_intent_id.
Payment status#
POST /payment/status reports where a payment attempt stands. It never creates, confirms or changes anything.
Required parameters: post_id, payment_gateway, payment_method, payment_id, payment_secret, checkout_token, price_amount.
{
"payment_id": 123,
"status": "processing",
"provider_status": "processing"
}
status |
Meaning |
|---|---|
succeeded |
The payment is recorded as paid. |
failed |
A webhook recorded a failure, or the Stripe PaymentIntent is canceled. |
requires_action |
The Stripe PaymentIntent is waiting for the buyer (requires_action, requires_payment_method or requires_confirmation). |
processing |
The provider has the payment but it has not settled. |
unknown |
No provider payment has started yet. |
For an unpaid Stripe payment, Payment Page reads the bound PaymentIntent from Stripe at most once every 10 seconds per payment. provider_status is that raw PaymentIntent status, or empty when there is none.
Form routes (signed checkout and open)#
| Method | Route | Access | Purpose |
|---|---|---|---|
POST |
/form-stats/view |
Signed checkout | Counts one form view for the Analytics dashboard. Needs the form's pricing_token. Views from users with payment_page_settings are not counted. Stores one total per form per day, nothing per visitor. Limited to 30 per minute per IP address. |
POST |
/cart-recovery/capture |
Signed checkout | (Pro) Saves the buyer's email_address and first_name for abandoned-cart reminders. Accepted only when the form has Cart Recovery turned on. Limited to 12 per minute per IP address and 100 new addresses per form per hour (see payment_page_cart_recovery_capture_cap). |
GET |
/cart-recovery/unsubscribe |
Open | The unsubscribe link in every reminder email (id, token). Stops reminders for that address and shows a confirmation page. |
GET |
/bundled-templates/{slug}/preview.svg |
Open | SVG preview image of a form template bundled with Payment Page. |
Webhook routes#
| Method | Route | Purpose |
|---|---|---|
POST |
/webhook/stripe-callback/{mode} |
Receives Stripe events. |
POST |
/webhook/paypal-callback/{mode} |
Receives PayPal PAYMENT.CAPTURE.COMPLETED events. |
{mode} is live or test.
Payment Page acts on these Stripe events and acknowledges any other event without acting on it:
payment_intent.succeeded,payment_intent.payment_failed,payment_intent.processing,payment_intent.canceledsetup_intent.succeeded,setup_intent.setup_failed,setup_intent.canceledinvoice.paid,invoice.payment_failedcustomer.subscription.created,customer.subscription.updated,customer.subscription.deleted
An event must also carry the payment ID and site domain that Payment Page attached to the Stripe object. Each event is processed once, even when Stripe delivers it again.
When you connect Stripe, Payment Page creates its own webhook endpoint for that mode with these events and saves the signing secret. Setup details: Stripe Webhook Configuration and PayPal Webhook Configuration.
Calling a route from PHP#
The standard WordPress REST helpers work. Admin routes need a current user with payment_page_settings.
$request = new WP_REST_Request( 'GET', '/payment-page/v1/administration/dashboard' );
$response = rest_do_request( $request );
$data = $response->get_data();
Plugin constants#
Defined in payment-page.php and lib/definitions.php:
| Constant | Value |
|---|---|
PAYMENT_PAGE_NAME |
'Payment Page' |
PAYMENT_PAGE_ALIAS |
'payment_page' (option and transient prefix) |
PAYMENT_PAGE_PREFIX |
'payment-page' (script and style handle) |
PAYMENT_PAGE_REST_API_PREFIX |
Same as PAYMENT_PAGE_PREFIX; the REST namespace is this plus /v1 |
PAYMENT_PAGE_ADMIN_CAP |
'payment_page_settings' |
PAYMENT_PAGE_VERSION |
The installed plugin version |
PAYMENT_PAGE_POST_TYPE_PAYMENT_FORM |
'pp_payment_form' |
PAYMENT_PAGE_TABLE_PAYMENTS, PAYMENT_PAGE_TABLE_LOG, PAYMENT_PAGE_TABLE_STRIPE_CUSTOMERS, PAYMENT_PAGE_TABLE_STRIPE_PRODUCTS, PAYMENT_PAGE_TABLE_STRIPE_PRICES, PAYMENT_PAGE_TABLE_FORM_STATS, PAYMENT_PAGE_TABLE_ABANDONED_CARTS |
Table names, without $wpdb->prefix |
if ( current_user_can( PAYMENT_PAGE_ADMIN_CAP ) ) {
// Runs only for users who can manage Payment Page.
}
Need help with an integration? Contact support.