Black Friday Sale is Live: Get up to 30% OFF RankReady Pro - the WordPress AI SEO pluginBlack Friday Sale is Live: Up to 30% OFF Get Deal
Reference

Every Hatch endpoint, referenced

Reference list of every route under /wp-json/hatch/v1/ in Hatch Connect 0.2, with HTTP methods and what each route is for.

Last updated October 29, 2026

This is the list of routes registered under /wp-json/hatch/v1/ by Hatch Connect 1.0.0, verified against the plugin source. Open /wp-json/hatch/v1/ on your own site to confirm the routes on your install, since some depend on your settings and active plugins. Descriptions are short summaries.

Who can call a route

  • Public: anyone can read it. The Lock the WordPress data feed switch on the Security tab can restrict these to signed-in users.
  • Public submit: open on purpose, like a contact form. The handler checks the input and applies its own nonce, key or rate limit.
  • Signed in: any signed-in account.
  • Admin: needs an administrator (the manage_options capability).
  • Session: needs a Hatch frontend session (Frontend accounts).

Content and site

Route Methods Access Purpose
/features GET Public Design, features and integration settings for the frontend.
/info GET Signed in Basic information about the site and plugin.
/design GET Public The design settings.
/content GET Public A single content item.
/content/list GET Public A list of content items.
/post/{id}/blocks GET Public for published posts Block output of a post. Password-protected and non-public posts are refused.
/menus, /menus/{location} GET Public Navigation menus.
/redirects GET Signed in Redirect rules.
/cpt-health GET Admin Custom post type health check.

SEO and plugin integrations

Route Methods Access Purpose
/seo-head, /schema GET Signed in SEO head tags and schema from your SEO plugin.
/seo-meta GET Public SEO meta from your SEO plugin.
/integrations GET Public Detected plugin integrations.
/acf-status GET Admin Advanced Custom Fields status.
/code-snippets GET Public Code snippets exposed to the frontend.
/order/{id} GET Public submit A guest’s WooCommerce order summary. It needs the order’s own key (?key=) and is rate limited; a wrong key returns the same 404 as a missing order.
/membership/check GET Signed in Membership check.

WooCommerce store (only when WooCommerce is active)

Route Methods Access Purpose
/store/products GET Public Product catalogue.
/store/products/{id} GET Public One product.
/store/products/{id}/variations GET Public Variations of a product.
/store/categories GET Public Product categories.
/store/featured GET Public Featured products.

Forms and comments

Route Methods Access Purpose
/forms GET Public List forms.
/forms/{provider}/{id} GET Public Read one form.
/forms/{provider}/{id}/submit POST Public submit Submit a form.
/comments GET, POST Public / Public submit Read and post comments. Not available if comments are turned off in Hatch.

Frontend accounts (only after you switch on Frontend accounts)

Route Methods Access Purpose
/auth/login POST Public submit Sign a visitor in.
/auth/register POST Public submit Create a visitor account.
/auth/logout POST Public submit Sign out.
/auth/me GET Session The signed-in visitor.
/auth/refresh POST Session Refresh the session.

Deploy and connection (dashboard use, Admin only)

Route Methods Purpose
/deploy/providers GET Available deploy providers.
/deploy/{provider}/token POST, DELETE Save or forget the provider token.
/deploy/{provider}/verify POST Check the token (the Check token button).
/deploy/{provider}/zones POST List domains for the address picker.
/deploy/{provider}/run POST Run a deploy.
/deploy/redeploy, /deploy/disconnect POST Redeploy or disconnect.
/deploy/status, /deploy/history GET Deployment state and history.
/connection-status GET Connection state.
/connection-check, /verify-connection POST Run a connection check.
/diagnostic GET Diagnostic report.
/refresh-cache, /revalidate POST Tell the frontend to refresh.
/options POST Save settings from the dashboard.

Not every route that changes data needs a login: form, comment and sign-in submissions are open by design and protect themselves with nonces, keys and rate limits. Everything that changes settings, deploys or triggers outbound requests needs an administrator.

What to do next

Read the REST bridge explained.