Components

The global updater: one row per plugin, theme or WordPress version, aggregated across every website the token can reach. Public filters: type[] (plugin, theme, core), site[], team[] and tags[] (ids), update_available, has_vulnerabilities, is_abandoned, closed, and s for a free-text search on the name. Public sorts: sites_updatable (default, descending), name, vulnerabilities, released_at and sites_total. GET /components/search looks up wordpress.org itself ahead of an install, not the organization’s inventory. The five write endpoints - install, {component}/upgrade, {component}/manage (activate or deactivate), {component}/uninstall and {component}/visibility - each launch one Site Action per selected website (visibility is a direct flag with no Site Action) and answer 202 with the created site-actions plus the websites a preflight skipped; none of them use a two-phase confirmation on this surface.