EventON APIfy

WordPress plugin that exposes protected REST API endpoints for EventON ajde_events, including pagination, search, create, update, delete, and RSVP delta-sync operations for administrator-authenticated integrations.

Contents

• Quick start
• Features
• Requirements
• Installation
• Packaging
• Development quality gates
• Releases
• Authentication
• Privacy
• MCP compatibility
• MCP schema manifest
• API reference
• Automatic updates
• Related packages
• License

Quick start

1. Copy this plugin into your WordPress plugins directory.
2. Activate EventON APIfy.
3. Go to Settings -> EventON APIfy.
4. Enable Event API and the capabilities you want to expose.
5. Create a WordPress Application Password for an administrator user.
6. Call the endpoint:

curl -u your_username:your_app_password \
  "https://your-site.com/wp-json/eventonapify/v1/events?per_page=10&page=1"

See GitHub Releases for the changelog and the latest packaged build.

Features

• Dedicated namespace: eventonapify/v1
• List EventON events with pagination, search, status filtering, and exact slug lookup
• Fetch a single event by ID
• Create new ajde_events posts via REST
• Update existing events, including EventON timestamps, status, virtual, repeat, RSVP, and taxonomy-backed location/organizer metadata
• Trash events through the API
• Read yes-only RSVP attendance summaries for EventON RSVP events
• List RSVP attendee records and additional RSVP form fields for EventON RSVP events, including delta-sync reads by checkpoint
• Administrator-only access
• Global Event API switch plus per-capability toggles for event reads/writes and RSVP reads
• Optional wp/v2 compatibility mode for generic WordPress tools such as mcp-wp
• Read-only MCP schema manifest for clients that need an executable EventON content contract
• Compatible with WordPress Application Passwords
• Git Updater metadata included for dashboard-based GitHub updates

Requirements

• WordPress 7.0+
• PHP 8.0+
• EventON installed and active
• HTTPS-enabled site recommended for secure API authentication

Installation

1. Install the packaged zip from GitHub Releases, or upload the plugin folder to /wp-content/plugins/eventon-apify/ when working from source in local development.
2. Activate it from Plugins in wp-admin.
3. Open Settings -> EventON APIfy.
4. Enable Event API.
5. Enable the capabilities you want available to administrators.
6. If you are using a generic WordPress client such as mcp-wp, also enable WP v2 compatibility.
7. If you installed from GitHub and want in-dashboard updates, install Git Updater.

Upgrade note: from 1.3.2 onward, the plugin keeps a backup copy of the API and WP v2 compatibility settings so future upgrades can restore them if those options go missing during an update.

Packaging

Build an installable plugin zip from the repo root:

./build.sh

That creates a file like eventon-apify-x.y.z.zip in the project root, ready to upload in Plugins -> Add New -> Upload Plugin.

Development quality gates

Composer dependencies are development-only and are excluded from release packages. Install and run the complete local gate with:

composer install
composer quality

The individual commands are:

• composer lint — WordPress security, deprecated API, alternative-function, and global-prefix PHPCS rules.
• composer analyse — PHPStan analysis against WordPress stubs.
• composer test — the dependency-free PHP unit suite.
• composer performance — the deterministic 10,000-record RSVP helper budget.
• XDEBUG_MODE=coverage composer coverage — unit coverage report and minimum line-coverage gate; writes coverage.json.

CI runs the quality gate with Xdebug, uploads the coverage report, and separately exercises the supported PHP matrix and WordPress integration smoke test.

Releases

To publish a GitHub release with the WordPress-ready zip attached:

./release.sh x.y.z

That script:

• updates the plugin version in eventon-apify.php
• updates the stable tag in readme.txt
• requires release-notes/x.y.z.md with New Features, Improvements, and Bug Fixes sections
• commits the version bump
• creates and pushes the git tag vx.y.z
• verifies that the plugin header, EVENTON_APIFY_VERSION, and Stable tag all match

Pushing the tag triggers GitHub Actions, which runs ./build.sh, creates or updates the GitHub Release for that tag, uploads the generated zip asset automatically, and publishes the release body from release-notes/x.y.z.md plus the full changelog comparison link.

Example release notes file:

## New Features

- Add RSVP attendee delta sync with canonical `updated_at` timestamps.

## Improvements

- Improve API docs and request examples for event and RSVP routes.

## Bug Fixes

- Reject invalid `updated_after` values with a `400` validation error.

Authentication

This API requires WordPress authentication and checks for the manage_options capability.

Route access is controlled in two layers:

• Global switch: Event API
• Per-capability switches: List events, Read single event, Create events, Update events, Delete events, Read RSVP summary, List RSVP attendees

Recommended method: Application Passwords.

1. Go to Users -> Profile.
2. Create a new application password.
3. Use username:application_password in Basic Auth.

Example:

curl -u your_username:your_app_password \
  "https://your-site.com/wp-json/eventonapify/v1/events?search=ride&status=publish,draft"

Single-event example:

curl -u your_username:your_app_password \
  "https://your-site.com/wp-json/eventonapify/v1/events/123"

Privacy

EventON APIfy works with EventON data stored in standard WordPress/EventON post meta and taxonomy meta rather than creating its own custom tables.

Depending on the enabled routes and submitted payloads, that data can include:

• organizer contact details
• location contact details
• virtual event credentials and visibility settings
• RSVP notification email recipients

Both the custom namespace and the optional wp/v2 compatibility mode are intended for administrator-authenticated access only. Site owners remain responsible for their privacy disclosures, retention policies, and any export/erasure workflows required for EventON-managed content.

MCP compatibility

If you use InstaWP mcp-wp or another WordPress MCP server, use ajde_events as the content type and fetch the EventON APIfy MCP manifest first when the client supports plugin-published contracts.

The manifest now advertises the custom EventON APIfy events route as the preferred content endpoint for EventON event reads and writes:

• Content type: ajde_events
• Preferred content endpoint: /wp-json/eventonapify/v1/events

If your client specifically requires the standard WordPress namespace, enable WP v2 compatibility in Settings -> EventON APIfy. That additionally exposes EventON through the standard WordPress REST API:

• Content type: ajde_events
• Content endpoint: /wp-json/wp/v2/ajde_events
• Taxonomies: event_type, event_location, event_organizer

Recommended mcp-wp usage:

• Use content_type: "ajde_events" for content operations
• Send EventON-specific fields either at the top level or inside custom_fields / fields, including featured_media, start_date, start_time, end_date, end_time, timezone, event_status, location, organizers, flags, virtual, repeat, and rsvp
• Use the MCP taxonomy tools for event_type, event_location, and event_organizer when you want direct taxonomy-level operations
• Fetch the EventON APIfy MCP manifest first if your MCP server supports plugin-published content contracts

Important: the wp/v2 compatibility endpoints are also restricted to administrator-authenticated requests. Compatibility responses redact sensitive fields such as virtual access secrets and notification email metadata.

MCP schema manifest

EventON APIfy also publishes a read-only discovery contract for compatible MCP servers:

• Manifest: /wp-json/eventonapify/v1/mcp-schema
• Content type detail: /wp-json/eventonapify/v1/mcp-schema/ajde_events
• Content type detail: /wp-json/eventonapify/v1/mcp-schema/event_rsvps when the RSVP addon is active

The manifest describes:

• preferred_endpoint: "eventonapify/v1/events"
• preferred_write_mode: "fields" for structured client input
• normalized EventON fields with nested object and array shapes
• executable validation_rules plus additional runtime validation_notes
• examples.create and examples.update payloads for MCP clients
• coarse runtime availability such as whether EventON is active, the custom API is enabled, and WP v2 compatibility is on
• when the RSVP addon is active, a read-only event_rsvps content type for /wp-json/eventonapify/v1/events/{event_id}/rsvps
• when the RSVP addon is active, the related RSVP summary endpoint /wp-json/eventonapify/v1/events/{event_id}/rsvps/summary

The manifest routes require an authenticated administrator, matching the event API authorization policy. Use a WordPress Application Password for automation clients.

Important: the manifest is discovery-only. Compatible clients should follow the advertised preferred_endpoint, which for ajde_events is /wp-json/eventonapify/v1/events. The contract examples are client-facing normalized payloads, not raw WordPress REST requests.

When using wp/v2, clients may send those normalized EventON fields directly on the request body or nest them inside fields / custom_fields.

Example:

curl -u your_username:your_application_password \
  "https://your-site.com/wp-json/eventonapify/v1/mcp-schema/ajde_events"

API reference

Routes

• GET /wp-json/eventonapify/v1/mcp-schema
• GET /wp-json/eventonapify/v1/mcp-schema/ajde_events
• GET /wp-json/eventonapify/v1/mcp-schema/event_rsvps when the RSVP addon is active
• GET /wp-json/eventonapify/v1/events
• GET /wp-json/eventonapify/v1/events/<id>
• GET /wp-json/eventonapify/v1/events/<id>/rsvps/summary
• GET /wp-json/eventonapify/v1/events/<id>/rsvps
• POST /wp-json/eventonapify/v1/events
• PUT /wp-json/eventonapify/v1/events/<id>
• PATCH /wp-json/eventonapify/v1/events/<id>
• DELETE /wp-json/eventonapify/v1/events/<id>

Settings capability map

Setting	Methods	Route	Effect when disabled
List events	GET	/events	Collection reads return 403
Read single event	GET	/events/<id>	Single-event reads return 403
Read RSVP summary	GET	/events/<id>/rsvps/summary	RSVP summary reads return 403
List RSVP attendees	GET	/events/<id>/rsvps	RSVP attendee reads return 403
Create events	POST	/events	Event creation returns 403
Update events	PUT, PATCH	/events/<id>	Event updates return 403
Delete events	DELETE	/events/<id>	Event deletion returns 403

List query parameters

Name	Type	Required	Description
per_page	integer	No	Items per page, default 20, max 100
page	integer	No	Page number, default 1
search	string	No	Search against event title/content
status	string	No	Comma-separated post statuses such as publish,draft
slug	string or array	No	Limit results to events matching one or more exact slugs; accepts a single slug, a comma-separated list, or an array (slug[]=a&slug[]=b)
starts_on_or_after	string	No	Only return events with an occurrence on or after this local date (YYYY-MM-DD); repeat occurrences are matched, not only the first
starts_before	string	No	Only return events with an occurrence strictly before this local date (YYYY-MM-DD); repeat occurrences are matched, not only the first
upcoming	boolean	No	When true, only return events starting today or later in the site timezone; ignored if starts_on_or_after is set
order	string	No	Sort direction: asc (default) or desc
orderby	string	No	Sort field: start_at (default), created, modified, or title

When a date filter (starts_on_or_after, starts_before, or upcoming) is active, occurrence matching runs in PHP so repeating events are matched on any occurrence. The candidate set is capped at 2000 events (filterable via eventon_apify_occurrence_scan_limit); if the cap is reached the response includes truncated: true rather than presenting a partial result as complete.