The plugin registers three custom REST routes (namespace fshipping/v1).

​
GET /wp-json/fshipping/v1/rate-quote

Public rate calculator used by [fshipping_rate_widget] and integrations. Permission: public (__return_true). Query arguments Behavior
  • Rate limit: 60 requests per hour per client IP (sliding hour via transient). Exceeding it returns HTTP 429 with {"ok":false,"error":"rate_limited"}.
  • Response cache: 15 minutes per unique argument set (transient fshipping_rq_<hash>); cache hits report "source":"cache".
  • Responses are CORS-enabled for browser widgets.
  • Successful shape: {"ok":true,"source":"live"|"cache","rates":[...]} where rates mirrors FedEx rateReplyDetails normalized per service.
This endpoint triggers live FedEx billing-free rate lookups — it costs your FedEx API quota, hence the IP limit and cache.

​
POST /wp-json/fshipping/v1/aiv-webhook

FedEx AIV event receiver. Full contract, signature scheme, and fail-closed behavior in AIV webhooks. Returns 200 {"ok":true,"count":N}, 401 invalid_signature, or 400 invalid_payload.

​
POST /wp-json/fshipping/v1/orders/{order_id}/openship/push

Triggers the Open Ship confirm/push pipeline for an order programmatically (same code path as the admin Confirm button). Permission: current_user_can('edit_shop_orders') — authenticated admin/shop-manager requests only (HTTP Basic, cookie, or your usual app-password auth). Anonymous calls get 403 fshipping_forbidden.
The Open Ship draft screen uses authenticated wp_ajax_ actions (not REST): fshipping_openship_save_packages, save_shipment_settings, restart_session, confirm, modify_package, delete_package_row, clear_all_packages — all require a logged-in admin session with nonce. Security notes for every public surface, including these, are collected on Security; the shortcodes that call some of these lookups are documented on Shortcodes; how the routes fit the wider code layout is on Architecture. Other wp_ajax_fshipping_* actions (pickup management, return creation, SPOD download, trade-document upload) check the fshipping_nonce plus manage_options / edit_shop_orders capabilities. Three handlers are also exposed nopriv (callable logged-out): fshipping_track_shipment, fshipping_validate_address, fshipping_validate_postal_code. They are read-only lookups, but the nonce they check is printed on public pages, so treat them as public endpoints: anonymous visitors can trigger FedEx API calls through them (quota consumption, not data exposure). fshipping_cancel_shipment is capability-gated (manage_woocommerce/manage_options) despite sharing that public nonce.