Pro API

Endpoints added by WP Social Ninja Pro, registered in Pro's app/Http/Routes/api.php. Pro reuses core policy classes (passed as fully-qualified strings) — it ships no policies of its own. Several route groups are additionally gated on WPSOCIALREVIEWS_DB_VERSION >= 121.

Base URL: https://your-site.com/wp-json/wpsocialreviews/v2

---

Managers

Prefix pro/settings · Policy: SettingsPolicy (core) · additionally gated on the wpsn_full_access capability inside the controller. Handler: ManagersController.

Method	Endpoint	Handler	Inputs	Response
GET	/pro/settings/managers	@getManagers	—	{ "managers": { "data": [{id,email,permissions}], "total" }, "permissions" }
POST	/pro/settings/managers	@addManagers	formData{ email, permissions[] }	{ "message" } (or 423 if user not found)
PUT	/pro/settings/managers	@updateManagers	formData{ email, permissions[] }	{ "message" }
DELETE	/pro/settings/managers/{id}	@removeManagers	path {id} (user ID)	{ "message" }

---

Imports & Quick Setup

Prefix pro/settings · Policy: SettingsPolicy (core). Handler: SettingsController (Pro). Quick-setup routes require WPSOCIALREVIEWS_DB_VERSION >= 121.

Method	Endpoint	Handler	Purpose	Response
POST	/pro/settings/woocommerce/import-reviews	@triggerWooImport	Start a WooCommerce reviews batch import	{ "success", "message" }
POST	/pro/settings/woocommerce/restart-import-reviews	@restartWooImport	Reset & restart the import	{ "success", "message" }
GET	/pro/settings/woocommerce/import-progress	@getWooImportProgress	Import progress	{ "success", "message", "data" }
POST	/pro/settings/fluent-cart/connect-all-products	@fluentCartProductConnection	Connect all FluentCart products	{ "success", "message", "data": { connected_count, skipped_count, errors } }
POST	/pro/settings/woocommerce/quick-setup	@wooQuickSetup	One-click WooCommerce review-hub setup	{ "success", "message", "data" }
POST	/pro/settings/fluent-cart/quick-setup	@fluentCartQuickSetup	One-click FluentCart setup	{ "success", "message", "data" }

These validate that the relevant plugin (WooCommerce / FluentCart) is active and the user has permission, returning 400/403/500 envelopes otherwise.

Review-collection QR codes

The pro/settings/get-reviews/qr-code… endpoints are also on this prefix but are handled by the core SettingsController — see Settings → QR Codes.

---

Captcha & FluentCRM Tag

Prefix pro/settings · Policy: ReviewsPlatformsSettingsPolicy (core). Handler: SettingsController (Pro).

Method	Endpoint	Handler	Inputs	Response
GET	/pro/settings/review-form-captcha	@getReviewFormCaptchaSettings	—	{ "success", "data" }
POST	/pro/settings/review-form-captcha	@saveReviewFormCaptchaSettings	type, settings	service result (or 422)
DELETE	/pro/settings/review-form-captcha	@clearReviewFormCaptchaSettings	type	service result (or 422)
GET	/pro/settings/fluentcrm-review-tag	@getFluentCrmReviewTagSettings	—	{ "success", "data": { has_fluentcrm, tags, … } }
POST	/pro/settings/fluentcrm-review-tag	@saveFluentCrmReviewTagSettings	enabled (bool), tag_name	{ "success", "message", "data" } (or 422)

---

Review Forms

Prefix pro/review-forms · Policy: ReviewFormPolicy (core). Handler: ReviewFormController. Registered only when WPSOCIALREVIEWS_DB_VERSION >= 121. These back the [wpsr_review_form] shortcode.

Method	Endpoint	Handler	Inputs	Response
GET	/pro/review-forms	@index	search, page, per_page (≤100)	{ "message": "success", "items": { data, total }, "total_items" }
POST	/pro/review-forms	@store	title, schema{}, settings{ general, spam }, status	{ "message", "form" }
GET	/pro/review-forms/{id}	@show	path {id}	{ "message": "success", "form" } (or 404)
PUT	/pro/review-forms/{id}	@update	path {id}, title, schema, settings, status	{ "message", "form" }
PUT	/pro/review-forms/status-update	@statusUpdate	ids[], status (enable/disable)	{ "message" }
DELETE	/pro/review-forms	@bulkDestroy	ids[]	{ "message" }
POST	/pro/review-forms/{id}/duplicate	@duplicate	path {id}	{ "message", "form" }

Form schema — field types: text, email, rating, textarea, media, privacy_policy, content_permission, hidden. Settings — general{ submit_button_text, success_message, duplicate_message, require_login, one_review_per_email, target_platform(native_form/fluent-cart/woocommerce) }, spam{ honeypot, captcha_type }.

Front-end submission (admin-ajax, not REST)

Visitors never reach the routes above. Submission and media upload go through admin-ajax.php so guests can post:

Action	Handler	Registered for
wpsr_submit_review_form	ReviewFormAjaxController@submit	wp_ajax_ and wp_ajax_nopriv_
wpsr_review_form_upload	TempFileUploader@upload	wp_ajax_ and wp_ajax_nopriv_

The JS serializes every field into a single URL-encoded data string, which the controller expands with parse_str() and merges back — so $request->get('field_name') keeps working. form_id is posted separately. Nonce, honeypot, captcha, and rate limiting are all enforced inside SubmissionHandler, not the controller.

Media arrives in two out-of-band maps, deliberately outside the data blob so the array contract is explicit rather than relying on parse_str() bracket-notation handling of URL-encoded keys:

Field	Shape	Purpose
wpsr_media_tokens	JSON map	Upload tokens for the submitted media
wpsr_upload_session_id	string	A single upload session
wpsr_upload_sessions 4.4.0	JSON map	One session per media field

Why wpsr_upload_sessions was added

A form with several media fields previously posted wpsr_upload_session_id once, so only the last value survived and the other fields' buckets were never claimed. The JSON map lets the submission claim every bucket. Each value is run through TempFileUploader::sanitizeSessionId(); entries that do not sanitize are dropped, and a non-array payload is ignored entirely.

Source: Pro app/Http/Controllers/ReviewForms/ReviewFormAjaxController.php, app/Hooks/Handlers/ReviewFormHandler.php

---

Custom Sources

Prefix pro/custom-sources · Policy: CustomSourcesPolicy (core). Handler: CustomSourcesController.

Method	Endpoint	Handler	Inputs	Response
GET	/pro/custom-sources	@index	search, filter, page, per_page	{ "message": "success", "items", "all_valid_platforms", "total_items" }
POST	/pro/custom-sources	@store	name, label, type (custom), form_id, is_manual_form (bool), native_form_id	{ "message", "source_id" } (or 422/423)
DELETE	/pro/custom-sources	@delete	ids[]	{ "message", "deleted_count", "total_count", "errors"? }
GET	/pro/custom-sources/{id}	@getSettings	path {id}	source settings (or 404)
POST	/pro/custom-sources/{id}/settings	@saveSettings	path {id}, settings	{ "message" } (or 422/404)
GET	/pro/custom-sources/forms/templates	@getTemplates	—	available Fluent Forms templates