=== Castomo WordPress Link ===
Contributors: castomo
Tags: rest api, api key, automation, ai, monitoring
Requires at least: 6.0
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.3.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Manage your whole WordPress site over a scoped REST API with per-key permissions, health checks and request monitoring. Built for automation and AI clients.

== Description ==

Castomo WordPress Link exposes a complete management REST API under `/wp-json/castomo/v1`, secured with API keys you create and control:

* **Multiple API keys, each with its own permissions.** Sixteen granular scopes (content, media, comments, taxonomies, users, settings, system, health, monitoring) or full access. Each key acts as a WordPress user of your choice, so WordPress capabilities still apply on top of the scopes.
* **Everything is manageable**: posts, pages and custom post types; media uploads (multipart, URL sideload or base64); comment moderation and replies; categories, tags and custom terms; users; site settings; plugin and theme activation; cron and cache.
* **Health check and monitoring built in**: `GET /health` reports database, HTTPS, debug mode, cron, disk space, updates and content counts with an overall ok/warning/critical status. Every API request is logged and visible both via `/monitor/*` endpoints and in an Activity tab in wp-admin. An optional unauthenticated `/ping` serves uptime monitors.
* **Designed for AI clients**: `GET /discovery` returns a machine-readable catalog of every endpoint plus the calling key's scopes and limits. A dedicated AI guide ships in the plugin's `docs/` folder next to the full endpoint reference.
* **Safety by default**: secrets are stored hashed and shown only once; keys can be rate-limited, given expiry dates and revoked instantly; the API refuses to deactivate the plugin itself or delete its own linked user; the request log records who did what.

Created by [Castomo](https://castomo.com) as the WordPress connector for its site-management and AI tooling — and useful for any script, cron job or agent that needs to drive WordPress remotely.

== Installation ==

1. Upload the plugin folder to `/wp-content/plugins/`, or install the zip via Plugins → Add New → Upload.
2. Activate it.
3. Go to **Settings → Castomo Link**, create an API key, choose its scopes and copy the key (it is shown only once).
4. Call `GET /wp-json/castomo/v1/discovery` with the key to see everything you can do.

== Frequently Asked Questions ==

= How do clients authenticate? =

Send the key with every request, either as `Authorization: Bearer cwl_...` or in the `X-Castomo-Key` header. Keys work only on the `castomo/v1` namespace.

= Can a key be limited to, say, comment moderation only? =

Yes. Create a key with just `comments.read` and `comments.write`. It will be able to list, approve, spam, edit, delete and reply to comments — and nothing else.

= Does this replace the core REST API? =

No, it complements it. The castomo namespace adds key-based auth with scopes, health/monitoring endpoints, request logging and AI-friendly conveniences (term names on write, URL sideloading, a discovery catalog).

= Which languages does the admin UI ship in? =

English, Polish, German, Spanish, Portuguese (Portugal and Brazil), French, Dutch and Danish. More are planned.

= Does uninstalling remove my data? =

Yes. Uninstall drops the plugin's tables (keys, request log and view counts) and its options. Deactivation keeps everything.

== Changelog ==

= 1.3.0 =
* View counter: counts visits to posts and pages on the server (no cookie, no JavaScript, no external service; the visitor's IP is never stored, only a one-way daily hash kept for two days to ignore reloads). Skips logged-in editors, robots, previews and prefetches. GET /views serves daily counts per post behind the content.read scope. Uninstall drops both tables.

= 1.2.0 =
* Site icon: GET /site-icon and PUT /site-icon (set from a URL or an existing media id, or remove) behind the existing settings.read and settings.write scopes. The icon must be square and at least 512 px. A site's title and tagline were already settable through PUT /settings.

= 1.1.0 =
* Essence export: GET /essence (site-clone manifest with design, menus, taxonomies, users and screenshot targets), GET /essence/content (all content incl. drafts as a nested semantic block tree) and GET /essence/media (full media inventory), behind the new essence.read scope. X-Castomo-Key is now an allowed CORS header for browser clients.

= 1.0.0 =
* Initial release: scoped API keys, full management API (content, media, comments, taxonomies, users, settings, system), health check, request log and monitoring endpoints, discovery catalog, admin UI in nine locales.
