Endpoints and Request Flows
Runtime routes are public by design and apply validation/security in callbacks. Administrative AJAX routes use nonces and capability checks in the audited managers.
The endpoint reference separates public visitor routes, signed WhatsApp webhooks, design-preview stubs, and authenticated administrator AJAX actions. Public permission callbacks allow the browser/provider to reach WordPress; validation, token format, message security, or HMAC checks happen inside the callback. Reverse proxies must preserve server-sent streaming and the raw signed Meta body.
The practical starting point is to confirm /wp-json/ai-website-chat/v2/token returns a 32-hex token. Continue through the workflow until you inventory admin ajax actions from each manager before adding proxy/cache rules, then use the field notes below to understand which choices affected AI output and which only changed delivery, access, or presentation.
What this feature does and when to use it
Section titled “What this feature does and when to use it”Use this reference for reverse-proxy, caching, monitoring, integration, and security review.
Use this feature in the following situations:
- You are configuring caching, a reverse proxy, monitoring, or firewall rules around SmartSite traffic.
- You need to trace a browser or WhatsApp request through validation and logging.
- You are reviewing whether an apparent endpoint documented elsewhere exists in the core or preview namespace.
Where to find it
Section titled “Where to find it”Before you begin
Section titled “Before you begin”- A staging site and a generated WordPress REST base URL.
- Authorization to inspect sanitized HTTP requests.
- No live credentials in commands or captured traffic.
Set it up step by step
Section titled “Set it up step by step”- Confirm /wp-json/ai-website-chat/v2/token returns a 32-hex token.
- Trace POST /chat as a server-sent event stream through validation, security, assistant, routing/knowledge, tools, OpenAI, and logging.
- Trace GET /messages with valid token and its maximum 100-message request.
- Trace /wp-json/smartsite/v1/active-channels frontend-safe output.
- Trace WhatsApp GET verification and signed POST message processing.
- Keep smartsite-design-preview/v1 routes confined to authenticated preview usage expectations.
- Inventory admin AJAX actions from each manager before adding proxy/cache rules.
Fields, controls, and important values
Section titled “Fields, controls, and important values”The routes below carry messages, history, channel data, previews, or administrator actions between systems. They do not improve the model by themselves, but a broken stream, altered body, missing token, or rejected signature can prevent a good response from being produced or delivered. Preserve each route’s validation and transport requirements when adding proxies, caches, or monitoring.
| Field, control, or status | What SmartSite Assistant does with it | How to use it and why it matters |
|---|---|---|
| GET ai-website-chat/v2/token | Public; returns random 32-hex user_token. | The public widget uses this route to obtain a random conversation token before sending messages. Keep it reachable without login, rate-monitor unusual use, and never reinterpret the token as verified identity or authorization. |
| POST ai-website-chat/v2/chat | Public callback; validates message/token, streams SSE, performs security/AI/tool flow, and logs. | This is the main streamed conversation path through message validation, security, OpenAI, knowledge, tools, state, and logging. Proxies must preserve server-sent events and avoid buffering away the incremental response. |
| GET ai-website-chat/v2/messages | Public callback; requires 32-hex token and requests up to 100 conversation messages. | Conversation history is returned only for a correctly formatted token and is capped at the documented limit. Treat the token as pseudonymous access to that history and prevent caches from mixing responses between visitors. |
| GET smartsite/v1/active-channels | Public frontend-safe active channel list. | The frontend reads this public, limited route to learn which channel links can be shown. Keep its response free of credentials and internal configuration; it should expose availability, not provider secrets. |
| GET/POST smartsite/v1/webhook/whatsapp | Public verification/inbound route; POST requires valid X-Hub-Signature-256. | GET completes Meta’s verification challenge, while POST receives signed WhatsApp events. Preserve the raw request body for signature checking and keep both methods outside page caching and browser-oriented transformations. |
| CORS | Core chat callbacks add Access-Control-Allow-Origin: *. | Cross-origin behavior affects whether a browser may call public routes from another origin; it does not replace token, message, capability, or signature validation. Allow only the origins needed by the actual deployment. |
How to confirm it is working
Section titled “How to confirm it is working”Judge Endpoints and Request Flows where its effect is actually consumed—by the administrator, visitor, model, or connected service. The expected result above is more useful than a green badge because it describes the behavior the configuration was meant to produce.
Practical example
Section titled “Practical example”A reverse proxy must not buffer the chat SSE response or rewrite the raw Meta POST body before WordPress validates its signature.
Recommended practice
Section titled “Recommended practice”- Change one part of Endpoints and Request Flows at a time and keep a short record of the previous value and test result.
- Verify the saved result in the screen, visitor session, or connected service that actually consumes the setting.
Important warnings
Section titled “Important warnings”Common problems and focused checks
Section titled “Common problems and focused checks”| Problem | What to check and what to do next |
|---|---|
| Endpoints and Request Flows is missing or does not match this guide. | Confirm the plugin is active and the account can manage WordPress options. Trace the request through capability, nonce or public validation, storage, runtime consumption, and error handling. |
| A change on Endpoints and Request Flows does not produce the expected result. | Keep the exact notice and test case, then review the browser console and WordPress/PHP log. Trace the request through capability, nonce or public validation, storage, runtime consumption, and error handling. |
Commands
Section titled “Commands”Sanitized route discovery
Section titled “Sanitized route discovery”wp rest route list --fields=namespace,route,methods | grep -E 'ai-website-chat|smartsite'Screen reference
Section titled “Screen reference”- Capture
- Create a sequence diagram showing Browser → token/chat/messages, WordPress security/response service, OpenAI, tools, and logger; include WhatsApp as a separate signed flow.
- Show
- Route namespaces/methods, SSE, validation, OpenAI/tools, logs, WhatsApp signature
- Viewport
- Desktop, 1440 × 900
- Annotate
- Use numbered callouts only for controls referenced in the procedure.
- Redact
- OpenAI keys, tokens, secrets, personal information, private URLs, IP addresses, and conversation text