An API for the
whole community
277 endpoints and 394 operations across two namespaces, buddynext/v1 (Free) and buddynext-pro/v1 (Pro), spanning 29 domains from the feed to membership, payments, AI, and analytics. WordPress Application Password auth, an App Shell bootstrap, and outgoing webhooks. It is the same layer the BuddyNext front end uses, and the one a native app will use.
The buddynext/v1 namespace ships with every install; buddynext-pro/v1 activates with BuddyNext Pro. This reference covers both.
POST /wp-json/buddynext/v1/posts Authorization: Basic <app-password> Content-Type: application/json { "content": "Hello, community", "space_id": 128 } 201 Created { "data": { "id": 9013, "status": "published", "created_at": "2026-07-14T10:42:00Z" } }
277
REST endpoints
Free + Pro
394
operations
GET / POST / PUT / DELETE
- 277
- REST endpoints
- Free + Pro
- 394
- operations
- GET / POST / PUT / DELETE
- 27
- API domains
- 12 Free, 15 Pro
- 2
- namespaces
- buddynext/v1 + -pro/v1
- 2
- auth methods
- App Password + nonce
What you get
Everything you need to build a real integration
No API add-on, no separate activation. Every BuddyNext install ships the full free REST layer, Application Password auth, and the webhook system from the start; BuddyNext Pro extends it with the buddynext-pro/v1 namespace.
277 REST endpoints
Every data type - feed, posts, members, profiles, spaces, messaging, moderation, notifications - is reachable over REST. Free ships 210 endpoints under buddynext/v1; Pro adds the buddynext-pro/v1 namespace for 277 in total. It is the same layer the BuddyNext front end uses, and the one a native app will use.
App Password and cookie auth
Non-browser clients authenticate with a WordPress Application Password over HTTP Basic. Logged-in browser clients use the WordPress auth cookie plus an X-WP-Nonce header. No custom token server to run.
App Shell bootstrap
One call to the App Shell surface returns the navigation and context a client needs to render its first screen, so app startup is a single round trip instead of a waterfall.
Outgoing webhooks
Register webhook endpoints, then read a full per-endpoint delivery log and fire a test delivery, all from the API. Diagnose an integration without guessing what your server received.
Two-factor and account security
The Auth domain covers registration, login, lost password, email and password changes, and two-factor with backup codes, so a companion app never has to reimplement account security.
WordPress Interactivity API
The front end is built on the WordPress Interactivity API - ES modules, no React, no jQuery, no build step. It consumes the exact same REST surface documented here.
27 API domains
Every part of the community, over REST
The 394 operations are organized into 29 domains across two namespaces. The numbers below are the exact operation counts from the live spec, not estimates. Domains marked Pro require BuddyNext Pro.
Members and Profiles
82Profiles, custom fields, the member directory, member types, avatars, and account settings. The largest surface in the API.
Spaces
45Public, private, and secret communities: create them, set privacy, manage members and moderators, and run the built-in forum.
Feed and Posts
42The activity feed and everything in it: composer, reactions, comments, polls, shares, bookmarks, and mentions.
Moderation and Trust
25The report button, the moderation queue, user actions, appeals, and content safeguards, all over REST.
Auth
23Registration, login, lost password, two-factor, email and password changes, and Application Password management.
Notifications
15In-app notifications and preferences: read state, counts, channels, and per-type delivery settings.
Social Graph
12Following, connections, follow requests, blocking, and presence, the relationships that make a community.
Search and Hashtags
12Site-wide search across members, posts, and spaces, plus hashtag discovery and trending topics.
Media and Albums
9Uploads, albums, and media attachments for posts and profiles, with per-item access control.
Webhooks
9Register outgoing webhook endpoints, inspect the delivery log, and fire a test delivery from the API.
App Shell
3The bootstrap surface a client calls on launch, including navigation, to hydrate the whole app in one place.
Admin
2Owner-only utilities such as slug availability checks, used by the front-end management screens.
Email (Broadcast & Drip) Pro
25Broadcast campaigns and multi-step drip sequences to members, with scheduling, segments, and delivery tracking over REST.
Membership Pro
12Paid membership plans, checkout, entitlements, and content protection, so access tiers are driven entirely by the API.
Advanced Moderation Pro
12Moderation rules, keyword filters, bulk actions, and automated enforcement beyond the free report queue.
Analytics Pro
8Community metrics and reporting: growth, engagement, and activity trends read straight from the API.
Push Notifications Pro
8Native mobile push tokens, delivery, and per-device preferences for a companion app.
Advanced Search Pro
8Richer discovery with saved searches and expanded filters across members, posts, and spaces.
Member Management Pro
7Owner-side member administration: roles, bulk operations, and lifecycle actions from the API.
Integrations Pro
5Bridges to the rest of the Wbcom suite, wired and toggled over REST.
Members and Profiles Pro
5Pro extensions to the member surface, layered on top of the free profile API.
Feed and Posts Pro
3Pro additions to the activity feed, available when BuddyNext Pro is active.
AI Pro
2AI-assisted endpoints for generating and moderating community content.
Moderation and Trust Pro
2Pro trust-and-safety endpoints that extend the free moderation surface.
Payments Pro
2Payment and gateway endpoints backing membership and monetization.
Realtime Pro
2Realtime presence and live-update endpoints for responsive clients.
Scheduled Posts Pro
1Schedule a post to publish to the feed at a future time.
Authentication
Standard WordPress auth, no token server
BuddyNext uses the auth WordPress already ships. A native app or integration sends an Application Password over HTTP Basic. A logged-in browser sends the auth cookie plus an X-WP-Nonce header. Nothing custom to run or rotate.
- Application Password over HTTP Basic for non-browser clients
- Auth cookie + X-WP-Nonce header for logged-in browsers
- Manage app passwords via /auth/app-password
- Two-factor, lost password, and account changes all in the Auth domain
# Non-browser client: Application Password GET /wp-json/buddynext/v1/notifications Authorization: Basic base64(user:app_pw) # Logged-in browser: cookie + nonce GET /wp-json/buddynext/v1/feed X-WP-Nonce: <wp_rest nonce> 200 OK { "data": [ ... ], "meta": { ... } }
Outgoing webhooks
Push community events to any URL
Register webhook endpoints over the API, then read a full delivery log per endpoint and fire a test delivery on demand. Build an integration you can actually debug, without guessing at what your server received.
Webhook operations
9 in Free/webhooks /webhooks /webhooks/{id} /webhooks/{id} /webhooks/{id} /webhooks/{id}/log /webhooks/{id}/test Register endpoints, inspect the delivery log, and send a test delivery, all over REST.
Platform depth
Built to plug in, not bolt on
The reference is generated from the live routes, the response envelopes are consistent, and the whole surface is designed for external consumers, from a mobile client to a moderation dashboard.
Generated from live routes
The OpenAPI document is generated from the plugin route registry by bin/gen-openapi.php, so the reference never drifts from what the server actually registers.
Consistent envelopes
List, single, and error responses follow a predictable shape across every domain, so a client can parse any endpoint the same way.
Native-app ready
Application Password auth, an App Shell bootstrap, and full account security make a mobile or desktop client a first-class consumer, not an afterthought.
Moderation over REST
The report queue, user actions, appeals, and safeguards are all API-driven, so trust and safety tooling can be built on the same contract.
Webhook delivery log
Every webhook endpoint keeps a delivery log you can read back over the API, plus a one-call test delivery to validate your receiver.
GPL and self-hosted
BuddyNext is GPL-2.0-or-later and runs on your own WordPress. The API is yours to extend with standard register_rest_route hooks.
Developer FAQ
How do I authenticate against the BuddyNext API?
Two ways. Non-browser clients (a native app, a server integration) send a WordPress Application Password over HTTP Basic auth. Logged-in browser clients send the WordPress auth cookie plus an X-WP-Nonce header for the wp_rest action. There is no separate token server to run.
Does the REST API require any extra plugin or configuration?
The free buddynext/v1 API is active as long as BuddyNext is installed and activated. Its 210 endpoints register automatically on rest_api_init, with no add-on and no toggle. The buddynext-pro/v1 namespace and its Pro endpoints register only when BuddyNext Pro is also active.
What is the base URL for the API?
The base is your site REST root plus the namespace: https://your-site.com/wp-json/buddynext/v1 for the free surface, or https://your-site.com/wp-json/buddynext-pro/v1 for the Pro surface. In the interactive reference, set your host in the Servers dropdown, then use Authorize before running a request.
How do outgoing webhooks work?
Register one or more webhook endpoints through the Webhooks domain. Each endpoint keeps a delivery log you can read back over the API, and you can trigger a test delivery to confirm your receiver is reachable before relying on it in production.
Can I build a mobile app on this API?
Yes. The REST surface is the same layer the BuddyNext front end uses, with Application Password auth, a single App Shell bootstrap call, and full account security including two-factor. It is designed for external consumers, not only the built-in UI.
Does this document include BuddyNext Pro endpoints?
Yes. The reference now covers both namespaces: buddynext/v1 (Free) and buddynext-pro/v1 (Pro), which adds membership, payments, AI, analytics, broadcast and drip email, push notifications, and advanced moderation and search. The Pro namespace registers only when BuddyNext Pro is active, so those endpoints appear against a site that runs Pro.
Build on a community engine you own
277 endpoints across two namespaces, standard WordPress auth, and outgoing webhooks. The free buddynext/v1 layer ships with every install; buddynext-pro/v1 activates with Pro. No add-on, no extra configuration step.