AJAX Endpoints

LMS Notes is driven by WordPress AJAX (admin-ajax.php) rather than a REST API. There are no custom REST routes. The endpoints below are what the front-end JavaScript calls.

Security

Most actions verify the nonce named lcn_ajax_security, created and passed to the front end as lms_notes_ajax_object.ajax_nonce. Different endpoints read the nonce from different parameters (ajax_nonce, nonce, or _wpnonce), matching how each request is built.

Endpoints

Action	Logged-out access	What it does
`lcn_save_course_note`	No	Create or update the current user’s note for a content item, including labels and meta.
`lcn_edit_custom_note`	No	Update a note’s title and content.
`lcn_delete_custom_note`	No	Delete a single note and clear its cached copy.
`lcn_delete_note`	No	Bulk-delete notes by an array of IDs.
`search_students_and_notes`	Yes	Search students or notes (used to populate filter dropdowns).
`search_notes`	Yes	Search a user’s notes by term or label and return the rendered rows.
`tag_suggestions`	Yes	Return label suggestions, creating a label term if it does not yet exist.

Non-AJAX request handlers

Two features run on template_redirect via query-string parameters rather than AJAX:

Export a single note

Append a parameter to a note’s permalink:

?print-notes=pdf - stream a PDF.
?print-notes=word - download a .docx.
?print-notes=print - render a print-ready page.

Bulk download

<note-page-url>?action=lcn_download_note&bulk_actions=download&note_ids=12,34,56

Returns a single .docx containing the selected notes.

Localized front-end object

The public script receives an object named lms_notes_ajax_object with:

Key	Value
`ajax_url`	`admin-ajax.php` URL
`ajax_nonce`	The `lcn_ajax_security` nonce
`current_user_id`	Current user ID
`update_text`, `success_text`, `delete_notes_txt`	Translatable UI strings