JWTs
Overview
Issue and manage AAM JWTs. Routes use /wp-json/aam/v2 on a standard WordPress installation.
Endpoints
| Method | Route | Input | Purpose |
|---|---|---|---|
| GET | /jwt/{id} |
id, fields |
Get token. |
| PATCH | /jwt/{id} |
id |
Refresh token. |
| DELETE | /jwt/{id} |
id |
Delete token. |
| GET | /jwts |
fields |
Get tokens. |
| POST | /jwts |
expires_at, expires_in, is_refreshable, is_revocable, additional_claims, description, fields |
Create token. |
| DELETE | /jwts |
— | Reset tokens. |
PATCH rows also accept POST and PUT because WordPress registers them as editable routes. The Input column lists route-specific parameters. A path parameter in {braces} is required. WordPress validates body and query parameters against the registered route schema.
Parameter guide
The route table shows which operation uses each parameter. Path parameters are required; other requirements depend on the operation.
| Parameter | Type | Meaning |
|---|---|---|
additional_claims |
mixed |
Any additional claims to include in the token. |
description |
string |
JWT token description. |
expires_at |
date-time |
Well formatted date-time when the token expires. |
expires_in |
string |
Relative datetime format. |
fields |
string |
List of additional fields to return. |
id |
string |
Token unique ID. |
is_refreshable |
boolean |
Wether issued JWT is refreshable. |
is_revocable |
boolean |
Wether issued JWT is revocable. |
Access level and authorization
JWT management routes require access_level=user and user_id=<id>. The path id identifies a token belonging to that user.
Required permission: aam_manager and the JWT management capability. See Authentication and Error handling.
JWT routes that act on a token use AAM’s token id in the path. Token creation requires a user access level.
Example
GET /wp-json/aam/v2/jwts?access_level=user&user_id=42
Authorization: Basic <base64 username:application-password>This lists JWTs for user 42. The authenticated caller must be allowed to manage those tokens.