AJAX Endpoints

BuddyLists uses WordPress admin-ajax.php actions for its front-end interactions. There is no REST API and no WP-CLI command. Every action below is registered for logged-in users only (there are no wp_ajax_nopriv_ handlers) and checks the buddylists nonce.

Action	Purpose	Who may call it
buddylists_create_update_list	Create a list, or update one when list_id is posted. Accepts list_name, list_desc, list_visibility and optional cover_image and list_icon files. Returns the new list’s address.	Creating: members allowed by the create-list settings. Updating: whoever may manage the list.
buddylists_delete_list	Delete a list, its members, its followers and its image folder.	The owner or an administrator.
buddylists_manage_list_members	Add or remove people. Post add_member or remove_member with one user ID.	Whoever may manage the list.
buddylists_set_list_image	Set or clear one image. Post field as cover_image or list_icon, with the file, or remove to clear it.	The owner or an administrator.
buddylists_fetch_list	Fetch one list’s details for the edit window.	Whoever may manage the list.
buddylists_follow_list	Follow or unfollow a list. Post follow_action as user to follow a member instead.	Following a list needs permission to view it. Unfollowing is always allowed.
buddylists_search_users	Search people by name for the Add people panel. Post search, and optionally list_id.	Any logged-in member. Naming a list needs permission to manage it.

buddylists_manage_list_members also still accepts a members JSON array of user IDs and works out the additions and removals from the difference. The list page does not use it, because it shows one page of people at a time.

Removed actions

These no longer exist and are not registered:

• buddylists_send_message. Messaging is a link to the BuddyPress compose screen.
• buddylists_get_members and buddylists_user_details. The list page reads its people on the server, behind the same permission check as the page.

Rate limiting

A shared helper caps how often an action can run for each user, using a one-minute transient:

Action	Limit per minute
buddylists_create_update_list	10
buddylists_manage_list_members	60, shared between adding and removing
buddylists_search_users	60
buddylists_follow_list	30

Going over a limit returns an error message asking the caller to wait. The other actions are not rate limited.

Validation notes

• A list name is required and must be under 190 characters.
• Adding a person checks that the user exists and that the list is not full.
• The owner is a member of their own list and cannot be removed.
• Duplicate memberships and follows are rejected by unique keys in the database.
• Uploads are checked by their real file type. Only JPG, PNG and GIF are accepted, up to 5 MB or the server’s upload limit if lower. The size cap can be changed with the buddylists_image_max_bytes filter.
• Marking a notification read checks that the notification belongs to the current user.
• Following a member is refused when the Follow button setting is off. Unfollowing still works.