WP Manifestindependent plugin directory
manifest / integrations / ai1ec-rest-api

All-in-One Event Calendar REST API WP Registry grade A-. Low-severity findings · 1 findingWP RegistryLow-severity findings · 1 findingOpen the reportA-

REST API endpoints for All-in-One Event Calendar by Time.ly (legacy v3.x)

★ 1stars
8release downloads
v1.1.2latest · 8mo ago

Install

Download ai1ec-rest-api.zip From the v1.0.0 release on GitHub, Oct 30, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/gserafini/ai1ec-rest-api/releases/download/v1.0.0/ai1ec-rest-api.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

REST API endpoints for All-in-One Event Calendar by Time.ly plugin (legacy version 3.x).

Overview

This plugin provides RESTful API endpoints for the legacy All-in-One Event Calendar by Time.ly (version 3.x). Since Time.ly discontinued the free plugin and it's no longer available in the WordPress plugin directory, this API plugin helps maintain and automate event management for sites still using the legacy version.

Note: This plugin is designed for legacy All-in-One Event Calendar v3.x installations.

Features

  • Full CRUD operations for events
  • Venue and location management
  • Category management
  • Contact information support
  • WordPress application password authentication
  • Git Updater support for automatic updates
  • Automatic ai1ec_event_instances record creation (v1.2.0+) - required for calendar and widget display
  • Reliable multisite category assignment (v1.2.0+) - uses direct SQL to avoid taxonomy conflicts

Multisite Support

On WordPress multisite, the same term (e.g., "Lectures") can exist in multiple taxonomies with different term_taxonomy_id values. The standard wp_set_object_terms() function may resolve to the wrong taxonomy.

Starting with v1.2.0, this plugin uses direct SQL with term_taxonomy_id lookup specifically for the events_categories taxonomy, ensuring correct category assignment on multisite installations.

AI1EC also requires records in both ai1ec_events and ai1ec_event_instances tables for events to appear on calendar pages and agenda widgets. v1.2.0+ handles this automatically on create, update, and delete.

API Endpoints

Base URL: https://your-site.com/wp-json/ai1ec/v1

  • GET /ai1ec_api_events - List events
  • GET /ai1ec_api_events/{id} - Get single event
  • POST /ai1ec_api_events - Create event
  • POST /ai1ec_api_events/{id} - Update event
  • DELETE /ai1ec_api_events/{id} - Delete event
  • GET /ai1ec_api_categories - List categories

See full documentation at https://github.com/gserafini/ai1ec-rest-api

License

GPL v2 or later

Releases

3 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.1.2 latest
Feb 6, 2026 8mo ago
tag only
—
Oct 31, 2025 11mo ago
tag only
—
Oct 30, 2025 11mo ago
ai1ec-rest-api.zip
8
A- grade

Security

All-in-One Event Calendar REST API 1.0.0 · audited by WP Registry

Low-severity findings only.

1 low
Audited release
1.0.0
Findings
1
Worst severity
low
Content hash
b1259546a28ddf1bbf869df2…

Findings

  • low Event write API uses broad edit_posts gate and accepts client-supplied post_status

    missing_capability

    Create/update endpoints allow any user with edit_posts and pass $params['status'] into wp_insert_post/wp_update_post with only sanitize_text_field. This mirrors core post capabilities but is a wider surface than manage_options; ensure roles without publish_posts cannot force publish if that is unintended.

    ai1ec-rest-api.php:105-107

    Recommendation

    Use current_user_can('edit_post', $id) / publish_posts as appropriate and whitelist allowed statuses.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.