WordPress

A connected WordPress site is a blog account. You use it to create, schedule, update and delete the site's posts through the Blogs API. A self-hosted site that runs WooCommerce is also a store, so the same account works with the Commerce API. WordPress accounts are never targets of POST /v1/posts and have no inbox or social analytics.

#What you can do

#Before you start

The WordPress user who connects must be able to publish posts and upload files. Pozy checks both before it saves the account, so a contributor role that can only write drafts is refused. Each account is one site. To manage several sites, connect each one.

#Connect WordPress.com

curl "https://api.pozy.ai/v1/connect/wordpress?profileId=6710c3a9e4b0d2f1a8c95e21&redirect_url=https://app.example.com/connected" \
  -H "Authorization: Bearer $POZY_API_KEY"

const res = await fetch("https://api.pozy.ai/v1/connect/wordpress?profileId=6710c3a9e4b0d2f1a8c95e21&redirect_url=https:%2F%2Fapp.example.com%2Fconnected", {
  headers: { Authorization: `Bearer ${process.env.POZY_API_KEY}` },
});
const data = await res.json();
if (!res.ok) throw new Error(data.error);
// Redirect the site owner to data.authUrl

import os, requests

resp = requests.get(
    "https://api.pozy.ai/v1/connect/wordpress",
    headers={"Authorization": f"Bearer {os.environ['POZY_API_KEY']}"},
    params={"profileId": "6710c3a9e4b0d2f1a8c95e21", "redirect_url": "https://app.example.com/connected"},
)
auth_url = resp.json()["authUrl"]

The site owner approves access and picks one site on WordPress.com. Pozy asks for single-site access only, never access to every site on the WordPress.com account. Reconnecting the same site on the same profile refreshes the account in place.

When the connection fails, the browser returns to your redirect_url with error and platform=wordpress:

#Connect a self-hosted site

The site owner opens Users > Profile in WordPress admin, creates an Application Password, and gives it to you with their login username.

curl -X POST https://api.pozy.ai/v1/connect/wordpress/token \
  -H "Authorization: Bearer $POZY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "profileId": "6710c3a9e4b0d2f1a8c95e21",
    "siteUrl": "https://blog.example.com",
    "username": "editor@example.com",
    "applicationPassword": "abcd efgh ijkl mnop qrst uvwx"
  }'

const res = await fetch("https://api.pozy.ai/v1/connect/wordpress/token", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.POZY_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    profileId: "6710c3a9e4b0d2f1a8c95e21",
    siteUrl: "https://blog.example.com",
    username: "editor@example.com",
    applicationPassword: "abcd efgh ijkl mnop qrst uvwx",
  }),
});
const data = await res.json();
if (!res.ok) throw new Error(data.error);
console.log(data.account._id);

resp = requests.post(
    "https://api.pozy.ai/v1/connect/wordpress/token",
    headers={"Authorization": f"Bearer {os.environ['POZY_API_KEY']}"},
    json={
        "profileId": "6710c3a9e4b0d2f1a8c95e21",
        "siteUrl": "https://blog.example.com",
        "username": "editor@example.com",
        "applicationPassword": "abcd efgh ijkl mnop qrst uvwx",
    },
)
account_id = resp.json()["account"]["_id"]

siteUrl must be the public HTTPS root of the site. Leave out /wp-json, paths and any credentials. Before saving, Pozy finds the site's REST API, refuses private or local network addresses, checks the credentials and confirms the user can publish and upload.

#Publish an article

List the blog first and use blogs[0].id. That way the same code works for self-hosted ("1") and WordPress.com (numeric site id) accounts.

curl -X POST https://api.pozy.ai/v1/accounts/6710c4b2e4b0d2f1a8c95e3a/blogs/1/articles \
  -H "Authorization: Bearer $POZY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Five things we learned shipping our mobile app",
    "bodyHtml": "<p>We spent six months on it. Here is what surprised us.</p>",
    "excerpt": "Lessons from six months of mobile work.",
    "tags": ["engineering", "mobile"],
    "author": "7",
    "image": { "url": "https://cdn.example.com/mobile-launch.jpg", "altText": "Phone showing the app home screen" },
    "publishDate": "2026-11-12T08:00:00Z"
  }'

What WordPress does with each field:

Responses include WordPress's own status (publish, future, draft, pending or private). isPublished is true only for publish. On update, leaving out image keeps the current featured image, and there is no way to remove one through the API.

#WooCommerce

When a self-hosted site runs WooCommerce and the connected user can manage it, GET /v1/commerce/store?accountId=... lists store capabilities and the account works with the Commerce API. WordPress.com sites cannot reach WooCommerce through Pozy.

Pozy registers order and product webhooks on the site when you connect it, so you get commerce.order.* and commerce.product.* events. Order attribution needs WooCommerce 8.5 or later with Order Attribution turned on, and records only the last visit.

#Limits

• No social posts, comments, DMs, analytics or inbox on a WordPress account.
• You cannot create, rename or delete the site's blog (405).
• Custom post types and categories are not managed through the Blogs API. Pages are available through the Commerce pages endpoints.
• Deletes are permanent. Pozy keeps no copy. WordPress keeps the post's media and tags for other content.

#Errors

#Endpoints

#Webhook events