AJAX Endpoints

BuddyLists uses WordPress admin-ajax.php actions for its front-end interactions. There is no REST API and no WP-CLI command; all dynamic behaviour goes through the actions below. Sensitive actions perform nonce, capability and ownership checks, and the write-heavy actions are rate limited (see below).

Action	Purpose
buddylists_create_update_list	Create a new list or update an existing one.
buddylists_delete_list	Delete a list the caller owns.
buddylists_manage_list_members	Add or remove members on a list.
buddylists_fetch_list	Fetch a single list’s data.
buddylists_fetch_members	Fetch the members of a list.
buddylists_get_members	Retrieve members for display.
buddylists_search_users	Search users to add to a list.
buddylists_load_more_users	Paginate the user search results.
buddylists_user_details	Return details for the profile preview popup.
buddylist_activity_load	Load the combined activity feed for a list.
buddylists_follow_list	Follow or unfollow a list.
buddylists_send_message	Send a group message to selected list members.

Rate limiting

A shared helper caps how often the write actions can run per user:

• Create or update a list: up to 10 per minute.
• Send a group message: up to 20 per minute.
• General default cap: 30 per minute.

Exceeding a limit returns an error asking the caller to wait.

Validation notes

• Adding a member validates that the target user exists.
• A user cannot add themselves to their own list, and duplicate memberships and follows are rejected at the database level.
• Group message recipients are validated against the list’s membership.
• Marking a notification read validates that the notification belongs to the current user.