REST API

Woo Sell Services registers read-only REST routes under the wss/v1 namespace (since 5.8.7). Every route declares a real permission_callback; none is public and none uses __return_true. The routes back the admin Order Conversations screen and are available to external integrations.

Authentication

Use a standard WordPress authentication method for REST (for example an Application Password) as the appropriate user. Authorization is enforced per route by capability or by order-party ownership.

Routes

GET /wss/v1/conversations

Paginated conversation messages across all orders.

• Permission: manage_woocommerce (store manager).
• Query args: page (default 1), per_page (default 20, max 100).
• Response headers: X-WP-Total, X-WP-TotalPages.

Each message is shaped as:

{
  "id": 12,
  "order_id": 123,
  "item_id": 45,
  "product_id": 67,
  "author_id": 8,
  "user_id": 9,
  "message": "Sanitized message content",
  "msg_time": "2026-01-01 10:00:00"
}

GET /wss/v1/conversations/{order_id}

Messages for one order, oldest first.

• Permission: manage_woocommerce, or a buyer/vendor who is a party to that order (via the shared ownership guard wss_user_is_order_party()).
• Query args: page, per_page (max 100).
• Response headers: X-WP-Total, X-WP-TotalPages.

GET /wss/v1/notifications

The current user’s own notifications, paginated.

• Permission: any logged-in user.
• Query args: page, per_page (max 100).
• Response headers: X-WP-Total, X-WP-TotalPages.

Example

curl --user "admin:APPLICATION_PASSWORD" \
  "https://example.com/wp-json/wss/v1/conversations?per_page=50&page=1"

Notes

• The routes are read-only; posting messages and moderation still happen through the frontend order flow and the admin Order Conversations screen.
• The data layer is Woo_Sell_Services_Conversation_Model (get_messages(), count_messages(), get_user_notifications()), which also enforces the order-party ownership guard.