AJAX & REST API Endpoints

BricksMembers provides AJAX endpoints for admin/frontend operations and several REST route families under bricksmembers/v1. Current REST routes include generic webhooks, Open Badges badge/assertion reads, Video Picker provider searches, and Payments billing routes for checkout, taxes, provider catalogs, subscriptions, payments, invoices, PayPal confirmation, and webhooks.

AJAX Endpoints

AJAX endpoints require proper authentication and nonce verification. Use them from JavaScript in the admin area or frontend.

Making AJAX Requests

// In WordPress admin
jQuery.ajax({
    url: ajaxurl,
    type: 'POST',
    data: {
        action: 'brm_assign_user_level',
        nonce: brmAdmin.nonce,  // Provided by plugin
        user_id: 123,
        level_id: 456
    },
    success: function(response) {
        if (response.success) {
            console.log('Level added:', response.data);
        } else {
            console.error('Error:', response.data.message);
        }
    }
});

// Modern fetch API
fetch(ajaxurl, {
    method: 'POST',
    headers: {
        'Content-Type': 'application/x-www-form-urlencoded',
    },
    body: new URLSearchParams({
        action: 'brm_assign_user_level',
        nonce: brmAdmin.nonce,
        user_id: 123,
        level_id: 456
    })
})
.then(response => response.json())
.then(data => {
    if (data.success) {
        console.log('Success:', data.data);
    }
});

Common Admin Endpoints

// Selected admin endpoints (see docs/api/ajax-handlers.md for full list)
brm_assign_user_level    // Assign a level to a user
brm_remove_user_level    // Remove a level from a user
brm_bulk_user_action     // Bulk assign/remove levels
brm_get_structure        // Fetch structure data
brm_duplicate_structure  // Duplicate a structure
brm_get_available_levels // Structure Quick Add metadata (levels + capability-filtered authors)
brm_quick_add_post       // Structure Quick Add create (supports post_author)
brm_get_quick_edit_fields // Structure Quick Edit payload (includes authors for header popover)
brm_quick_edit_post_fields // Structure Quick Edit save (supports post_author)
brm_get_structure_content_item // Structure Content Editor selected-post payload
brm_save_structure_content_fields // Structure Content Editor native Content Fields save
brm_save_structure_content_acf // Structure Content Editor compatible custom field save
brm_search_posts         // Search posts for admin selectors
brm_search_terms         // Search taxonomy terms
brm_search_users         // Search users
brm_search_content       // Unified content search
brm_save_download        // Save protected downloads (Protected Downloads module)
brm_regenerate_api_key   // Rotate API key
brm_send_test_webhook    // Send test webhook
brm_save_webhook_fields  // Save webhook field mappings

Frontend Endpoints

// Progress tracking (requires logged-in user)
brm_mark_progress
brm_toggle_progress
brm_get_progress_data
brm_get_next_post

Response Format

All AJAX endpoints return JSON with a success boolean and either data or an error message.

REST API Endpoints

The generic webhook endpoint is one REST surface. Since 1.1.0, BricksMembers also includes an optional Headless REST API under the same bricksmembers/v1 namespace. Enable it from BricksMembers → Integrations → Headless REST API. Feature modules add their own route families when enabled:

// Endpoint URL
POST /wp-json/bricksmembers/v1/webhook

// Authentication: Query param secret, HMAC signature, or Authorization header
// See Webhooks API post for details

// Additional route families
GET  /wp-json/bricksmembers/v1/badges/*
GET  /wp-json/bricksmembers/v1/video-picker/*
POST /wp-json/bricksmembers/v1/billing/checkout
POST /wp-json/bricksmembers/v1/billing/create-embedded-checkout
GET  /wp-json/bricksmembers/v1/billing/checkout-status
POST /wp-json/bricksmembers/v1/billing/manage
POST /wp-json/bricksmembers/v1/billing/cancel
POST /wp-json/bricksmembers/v1/billing/refresh
POST /wp-json/bricksmembers/v1/billing/paypal/confirm
GET  /wp-json/bricksmembers/v1/billing/subscriptions
GET  /wp-json/bricksmembers/v1/billing/payments
POST /wp-json/bricksmembers/v1/billing/taxes/preview
GET  /wp-json/bricksmembers/v1/billing/taxes/export
GET  /wp-json/bricksmembers/v1/billing/taxes/reconcile
GET  /wp-json/bricksmembers/v1/billing/admin/provider-catalog/stripe
GET  /wp-json/bricksmembers/v1/billing/admin/provider-catalog/paypal
GET  /wp-json/bricksmembers/v1/billing/admin/provider-catalog/square
GET  /wp-json/bricksmembers/v1/billing/invoices
GET  /wp-json/bricksmembers/v1/billing/invoices/{id}/download
POST /wp-json/bricksmembers/v1/billing/invoices/{id}/regenerate
POST /wp-json/bricksmembers/v1/billing/webhook/stripe
POST /wp-json/bricksmembers/v1/billing/webhook/paypal
POST /wp-json/bricksmembers/v1/billing/webhook/square

// Headless REST API (since 1.1.0; gated by Integrations -> Headless REST API)
GET    /wp-json/bricksmembers/v1/me
GET    /wp-json/bricksmembers/v1/me/profile
PATCH  /wp-json/bricksmembers/v1/me/profile
GET    /wp-json/bricksmembers/v1/content
GET    /wp-json/bricksmembers/v1/content/3245/access
GET    /wp-json/bricksmembers/v1/structures
GET    /wp-json/bricksmembers/v1/me/progress
POST   /wp-json/bricksmembers/v1/me/progress/posts/3245/completion
GET    /wp-json/bricksmembers/v1/me/submissions
POST   /wp-json/bricksmembers/v1/me/submissions
GET    /wp-json/bricksmembers/v1/me/groups
GET    /wp-json/bricksmembers/v1/quizzes/{quiz_id}
GET    /wp-json/bricksmembers/v1/me/certificates
GET    /wp-json/bricksmembers/v1/me/downloads
GET    /wp-json/bricksmembers/v1/me/billing/subscriptions
GET    /wp-json/bricksmembers/v1/admin/settings/modules
PATCH  /wp-json/bricksmembers/v1/admin/settings/integrations

Headless REST API routes use standard WordPress REST authentication only: cookie authentication with a REST nonce, Application Passwords, or compatible JWT/OAuth plugins. Responses use a consistent envelope: { "success": true, "data": ..., "meta": ... } for success and { "success": false, "code": "...", "message": "...", "details": ... } for errors.

Webhook Request

// The webhook endpoint receives external webhook payloads
// Configure field mappings in BricksMembers → Integrations → Webhook Mapping
// to map external webhook data to level assignments

Webhook Authentication

Webhook authentication supports:

// Query param secret
POST /wp-json/bricksmembers/v1/webhook?secret=your_secret

// HMAC signature (uses the same secret)
X-BRM-Signature: sha256_hmac_signature

// API key in Authorization header
Authorization: Bearer {brm_api_key_option}

HMAC Signature Verification

// PHP example for generating HMAC
$payload = file_get_contents('php://input');
$secret = 'your_secret_key';
$signature = hash_hmac('sha256', $payload, $secret);

// Send in header
$headers = [
    'X-BRM-API-Key' => 'your_api_key',
    'X-BRM-Signature' => $signature,
    'Content-Type' => 'application/json'
];

Creating Custom AJAX Endpoints

You can create custom AJAX endpoints that integrate with BricksMembers:

// Register custom endpoint
add_action('wp_ajax_my_custom_action', function() {
    // Verify nonce
    check_ajax_referer('brm_ajax_nonce', 'nonce');

    // Check permissions
    if (!current_user_can('brm_manage_user_levels')) {
        wp_send_json_error(['message' => 'Insufficient permissions']);
    }

    // Use BricksMembers API
    $user_id = intval($_POST['user_id']);
    $level_id = intval($_POST['level_id']);

    $result = brm_add_user_level($user_id, $level_id);

    if ($result) {
        wp_send_json_success(['message' => 'Level added']);
    } else {
        wp_send_json_error(['message' => 'Failed to add level']);
    }
});

// Frontend endpoint (logged-in users)
add_action('wp_ajax_my_frontend_action', function() {
    check_ajax_referer('brm_frontend_nonce', 'nonce');

    if (!is_user_logged_in()) {
        wp_send_json_error(['message' => 'Must be logged in']);
    }

    // Your custom logic here
    wp_send_json_success(['data' => 'Result']);
});

Security Best Practices

  • Always verify nonces: Use check_ajax_referer() for AJAX requests
  • Check capabilities: Verify user permissions before operations
  • Sanitize input: Always sanitize and validate user input
  • Use API keys securely: Store API keys securely, never in code
  • Enable rate limiting: Webhooks include rate limiting by default

Rate Limiting

AJAX endpoints include automatic rate limiting (defaults are 10 requests/minute per user unless an action-specific override is defined in code). There is no filter to change these limits.

Get BricksMembers

Start Building Your Membership Site Today

Create, sell, and manage your content without limits. BricksMembers gives you everything you need to build membership and LMS sites with Bricks Builder.

Get BricksMembers

Lifetime updates & bug fixes • Premium support • 0% transaction fees • 60-day money-back guarantee