Every Payment Page route lives in the payment-page/v1 namespace, so the full URL is /wp-json/payment-page/v1/<route>.

Access rules#

Access How it is checked
Admin A logged-in user with the payment_page_settings capability, which Payment Page gives to the Administrator role. Any WordPress REST authentication works (cookie with a wp_rest nonce, or an application password).
Signed checkout No login. The request must carry the form's signed tokens. After the first call it must also carry the payment ID and the HMAC-SHA256 secret returned for that payment. Rate limits apply per IP address and per payment.
Webhook No login. Stripe requests must pass the Stripe-Signature check against the mode's signing secret. PayPal requests must include all five PAYPAL-* transmission headers and pass PayPal's signature verification for the mode's Webhook ID.
Open No login. Returns nothing private.

Admin routes#

Dashboard and form builder#

Method Route Purpose
GET /administration/dashboard Data for the Payment Page dashboard: gateway status per mode, Quick Setup steps and the template list.
POST /administration/dismiss-notification Dismisses the latest admin notification for the current user.
GET /administration/template-list Page templates available to import from the Payment Page template site, with whether the current plan can install each one.
POST /administration/set-quick-setup-skip Skips Quick Setup (status=1) or shows it again (status=0).
POST /administration/import-template Imports a template by id. A negative ID is a template bundled with Payment Page; a positive ID is fetched from the template site.
GET /administration/payment-forms/{id}/builder-data Field groups and saved values for the form builder.
any /administration/payment-forms/{id}/live-preview Renders the form as HTML for the builder preview, with any unsaved payment_page_settings applied.
POST /administration/payment-forms/{id}/test-email Sends sample admin and payer confirmation emails using the form's saved settings. Also requires permission to edit that form.

Payment gateways#

Method Route Purpose
GET /payment-gateway/connect Starts connecting a gateway (payment_gateway, is_live). For Stripe it returns the Stripe Connect onboarding URL.
GET /payment-gateway/connect-callback Return URL for Stripe Connect onboarding. It has no REST nonce, so it checks the administrator's WordPress login cookie and a single-use state that the same administrator started within the last 10 minutes. Then it saves the account keys for that mode.
POST /payment-gateway/disconnect Removes a gateway's credentials for one mode.
POST /payment-gateway/set-mode Switches a gateway between test and live.
POST /payment-gateway/set-payment-methods Saves the enabled payment methods for a gateway.
POST /payment-gateway/save-settings Saves PayPal credentials for one mode.
POST /payment-gateway/save-webhook-settings Saves the webhook signing secret (Stripe) or Webhook ID (PayPal) for one mode.
POST /payment-gateway/save-payment-method-settings Saves the settings of a payment method that has its own settings fields.

Elementor install#

Both routes accept only identifier=elementor. They let Quick Setup install Elementor and are not a general plugin installer.

Method Route Purpose
POST /plugin/install Installs Elementor from WordPress.org.
POST /plugin/activate Activates Elementor.

Feature updates#

Method Route Purpose
GET /tagging/area/{slug} Details of a feature area shown in the admin, read from the Payment Page features service.
POST /tagging/apply Sends an administrator's first_name, last_name, email_address and chosen tags for an area_slug to the Payment Page features service.

Checkout routes (signed checkout)#

The payment form calls these in order: sync the payment details, create the provider payment, then complete it.

Method Route Purpose
POST /payment/sync-details Creates the local payment record for a checkout attempt, or updates it before it is paid. Returns the payment id and its secret. Updates send _current_id and _current_secret. New records are limited to 12 per minute per IP address.
POST /stripe/payment-intent-or-setup Creates the Stripe PaymentIntent (one-time payment) or SetupIntent (subscription) for a synced payment.
POST /stripe/checkout Completes a Stripe checkout after the browser confirms it (stripe_payment_intent_or_setup_id): settles the one-time charge or starts the subscription.
POST /stripe/upsell-charge Charges a one-click post-purchase upsell to the card used for a completed one-time card payment. See Upsell charge.
POST /payment/status Read-only status of a payment attempt. See Payment status.
POST /paypal/order Creates, or reuses, the PayPal order for a synced one-time payment.
POST /paypal/order/capture Captures the PayPal order (order_id), checks the capture against the stored payment, then records the payment.

Every Stripe and PayPal route above (except /payment/status) allows 6 calls per minute per payment and 24 per minute per IP address. Requests over the limit get HTTP 429.

On the Free plan, Stripe payments are created on your connected account through the Payment Page API (api.paymentpageplugin.com), which adds the 2% Payment Page platform fee. With Pro, Payment Page creates them directly with Stripe.

Upsell charge#

POST /stripe/upsell-charge charges the offer configured on the form to the same customer and card as the original payment. It works only for a completed one-time card payment, and each offer can be charged once per original payment.

Parameter Value
post_id The form ID.
payment_id, payment_secret The original payment's ID and secret.
pricing_token The form's signed pricing token that the original payment used.
upsell_index Which configured offer to charge.
finalize_payment_intent_id Only on the second call, after the buyer authenticates the card.

Responses:

  • {"status": "ok"} when the charge succeeded or is processing.
  • {"requires_action": true, "payment_intent_id": "...", "payment_intent_secret": "..."} when the card needs authentication. The form completes it with Stripe.js, then calls the route again with finalize_payment_intent_id.

Payment status#

POST /payment/status reports where a payment attempt stands. It never creates, confirms or changes anything.

Required parameters: post_id, payment_gateway, payment_method, payment_id, payment_secret, checkout_token, price_amount.

{
  "payment_id": 123,
  "status": "processing",
  "provider_status": "processing"
}
status Meaning
succeeded The payment is recorded as paid.
failed A webhook recorded a failure, or the Stripe PaymentIntent is canceled.
requires_action The Stripe PaymentIntent is waiting for the buyer (requires_action, requires_payment_method or requires_confirmation).
processing The provider has the payment but it has not settled.
unknown No provider payment has started yet.

For an unpaid Stripe payment, Payment Page reads the bound PaymentIntent from Stripe at most once every 10 seconds per payment. provider_status is that raw PaymentIntent status, or empty when there is none.

Form routes (signed checkout and open)#

Method Route Access Purpose
POST /form-stats/view Signed checkout Counts one form view for the Analytics dashboard. Needs the form's pricing_token. Views from users with payment_page_settings are not counted. Stores one total per form per day, nothing per visitor. Limited to 30 per minute per IP address.
POST /cart-recovery/capture Signed checkout (Pro) Saves the buyer's email_address and first_name for abandoned-cart reminders. Accepted only when the form has Cart Recovery turned on. Limited to 12 per minute per IP address and 100 new addresses per form per hour (see payment_page_cart_recovery_capture_cap).
GET /cart-recovery/unsubscribe Open The unsubscribe link in every reminder email (id, token). Stops reminders for that address and shows a confirmation page.
GET /bundled-templates/{slug}/preview.svg Open SVG preview image of a form template bundled with Payment Page.

Webhook routes#

Method Route Purpose
POST /webhook/stripe-callback/{mode} Receives Stripe events.
POST /webhook/paypal-callback/{mode} Receives PayPal PAYMENT.CAPTURE.COMPLETED events.

{mode} is live or test.

Payment Page acts on these Stripe events and acknowledges any other event without acting on it:

  • payment_intent.succeeded, payment_intent.payment_failed, payment_intent.processing, payment_intent.canceled
  • setup_intent.succeeded, setup_intent.setup_failed, setup_intent.canceled
  • invoice.paid, invoice.payment_failed
  • customer.subscription.created, customer.subscription.updated, customer.subscription.deleted

An event must also carry the payment ID and site domain that Payment Page attached to the Stripe object. Each event is processed once, even when Stripe delivers it again.

When you connect Stripe, Payment Page creates its own webhook endpoint for that mode with these events and saves the signing secret. Setup details: Stripe Webhook Configuration and PayPal Webhook Configuration.

Calling a route from PHP#

The standard WordPress REST helpers work. Admin routes need a current user with payment_page_settings.

$request  = new WP_REST_Request( 'GET', '/payment-page/v1/administration/dashboard' );
$response = rest_do_request( $request );
$data     = $response->get_data();

Plugin constants#

Defined in payment-page.php and lib/definitions.php:

Constant Value
PAYMENT_PAGE_NAME 'Payment Page'
PAYMENT_PAGE_ALIAS 'payment_page' (option and transient prefix)
PAYMENT_PAGE_PREFIX 'payment-page' (script and style handle)
PAYMENT_PAGE_REST_API_PREFIX Same as PAYMENT_PAGE_PREFIX; the REST namespace is this plus /v1
PAYMENT_PAGE_ADMIN_CAP 'payment_page_settings'
PAYMENT_PAGE_VERSION The installed plugin version
PAYMENT_PAGE_POST_TYPE_PAYMENT_FORM 'pp_payment_form'
PAYMENT_PAGE_TABLE_PAYMENTS, PAYMENT_PAGE_TABLE_LOG, PAYMENT_PAGE_TABLE_STRIPE_CUSTOMERS, PAYMENT_PAGE_TABLE_STRIPE_PRODUCTS, PAYMENT_PAGE_TABLE_STRIPE_PRICES, PAYMENT_PAGE_TABLE_FORM_STATS, PAYMENT_PAGE_TABLE_ABANDONED_CARTS Table names, without $wpdb->prefix
if ( current_user_can( PAYMENT_PAGE_ADMIN_CAP ) ) {
    // Runs only for users who can manage Payment Page.
}

Need help with an integration? Contact support.