REST API

Burst Statistics exposes a custom beacon endpoint and a set of WordPress REST API routes under the burst/v1 namespace. This reference documents every endpoint visible in the v3.3.0 source.

Overview

Endpoint	Method	Auth	Permission
`{site}/burst-statistics/endpoint.php`	POST	None	Public
`burst/v1/track`	POST	None	Public
`burst/v1/menu`	GET	Nonce	manage
`burst/v1/fields/get`	GET	Nonce	manage
`burst/v1/fields/set`	POST	Nonce	manage
`burst/v1/options/set`	POST	Nonce	manage
`burst/v1/goals/get`	GET	Nonce	view
`burst/v1/goals/add`	POST	Nonce	manage
`burst/v1/goals/set`	POST	Nonce	manage
`burst/v1/goals/delete`	POST	Nonce	manage
`burst/v1/goals/add_predefined`	POST	Nonce	manage
`burst/v1/data/{type}`	GET	Nonce	view
`burst/v1/data/ecommerce/{type}`	GET	Nonce	view_sales
`burst/v1/do_action/{action}`	POST	Nonce	manage
`burst/v1/get_action/{action}`	GET	Nonce	view
`burst/v1/posts/`	GET	Nonce	manage
`burst/v1/mainwp-auth`	POST	RSA signature	Public*

Permission levels:

manage — requires manage_burst_statistics capability (typically administrators).
view — requires view_burst_statistics capability. Granted to administrators and to burst_viewer role holders accessing a share link.
view_sales — requires view_burst_statistics_sales capability (Pro, ecommerce data).

Tracking Endpoints

Beacon endpoint (`endpoint.php`)

The primary tracking endpoint. It is a standalone PHP file that bootstraps WordPress with SHORTINIT for performance, then calls Tracking::beacon_track_hit() to record a hit.

URL: {plugin_url}/burst-statistics/endpoint.php Method: POST Content-Type: application/x-www-form-urlencoded Authentication: None required.

Test request

Send request=test to verify the endpoint is reachable. The endpoint returns HTTP 200 on success.

// Server-side test (mirrors what Burst does internally)
$response = wp_remote_post(
    plugins_url( 'endpoint.php', BURST_FILE ),
    [
        'method'    => 'POST',
        'headers'   => [ 'Content-type' => 'application/x-www-form-urlencoded' ],
        'body'      => [ 'request' => 'test' ],
        'sslverify' => false,
    ]
);

CORS (cross-origin support)

By default the beacon endpoint only accepts same-origin requests. To allow hits from a different domain, define the BURST_ALLOWED_ORIGINS constant (comma-separated host names, no scheme or path) in wp-config.php:

define( 'BURST_ALLOWED_ORIGINS', 'app.example.com,cdn.example.com' );

When the constant is defined the endpoint:

Checks HTTP_ORIGIN against the allowed list.
If the origin matches, it reflects Access-Control-Allow-Origin, allows credentials, and accepts POST and OPTIONS methods.
If the origin does not match, it returns HTTP 403 and exits.

caution

If BURST_ALLOWED_ORIGINS is defined, any origin not in the list is rejected. Leave the constant undefined to keep the default same-origin-only behaviour.

Preflight OPTIONS requests receive HTTP 204 with an Access-Control-Max-Age: 3600 header.

`POST burst/v1/track`

WordPress REST API fallback tracking route. Used when the standalone endpoint.php beacon is unreachable (e.g., aggressive server-side caching or rewrite rules that block direct PHP file access).

Route: burst/v1/track Method: POST Content-Type: application/json Permission callback: __return_true (public, no authentication required).

Burst automatically determines whether to use the beacon or this REST route by running a connectivity test on plugin load (see Tracking status).

Test request

$response = wp_remote_post(
    get_rest_url( null, 'burst/v1/track' ),
    [
        'headers'     => [ 'Content-Type' => 'application/json; charset=utf-8' ],
        'method'      => 'POST',
        'body'        => wp_json_encode( [ 'request' => 'test' ] ),
        'data_format' => 'body',
        'timeout'     => 5,
    ]
);

HTTP 200 indicates the REST route is reachable.

Tracking status

Burst\Frontend\Endpoint manages which tracking method (beacon or REST) is active. The result is stored in the burst_tracking_status option with one of three values:

Value	Meaning
`beacon`	`endpoint.php` is reachable; primary tracking method.
`rest`	`endpoint.php` is not reachable; REST API fallback is used.
`error`	Neither method is reachable; no tracking is occurring.

The status is re-tested automatically:

Once every 24 hours when status is beacon or rest.
Once every 10 minutes when status is error (to recover faster).

The re-test interval can be overridden with the burst_time_between_tests filter.

Admin REST API

All admin routes are registered under the burst/v1 namespace. Every write request (POST) must include a valid burst_nonce nonce, typically via the X-WP-Nonce header.

`GET burst/v1/menu`

Returns the admin menu configuration used to build the settings UI.

Permission: manage

`GET burst/v1/fields/get`

Returns all field definitions and the full menu configuration.

Permission: manage