Every route needs an authenticated WordPress request and, unless noted otherwise, the
manage_options capability — filterable with boolean_smtp_rest_capability. The plugin adds no
REST-specific auth of its own, so it takes whatever WordPress core already accepts:
From the browser (the admin UI itself): a logged-in session plus a REST nonce (X-WP-Nonce).
From Postman, a script, or any external client: a WordPress Application
Password
(Users → Profile → Application Passwords on the site, then HTTP Basic Auth with the site
username and the generated password) — no nonce needed. Nothing in the plugin blocks or checks
for this; if an account can manage_options, its Application Password can call every route below,
free or Pro.
The free plugin registers no public route. Pro’s one exception is the provider webhook receiver, verified against a
secret instead of authentication (see Webhooks). There is no generic “send an arbitrary
email” endpoint: sending goes through wp_mail(), not the REST API.
settings is validated per-transport (TransportContract::validateSettings()) and its sensitive
fields — anything matching key, secret, password, token or username, plus whatever
boolean_smtp_sensitive_keys adds — come back masked, never
in full.
The manual-app flows for Google, Microsoft/Outlook and Zoho:
Method
Route
GET
/oauth/google/authorize
GET
/oauth/google/callback
GET
/oauth/microsoft/authorize
GET
/oauth/microsoft/callback
GET
/oauth/zoho/authorize
GET
/oauth/zoho/callback
authorize takes ?connection_id= and redirects to the provider’s consent screen; callback
exchanges the code for tokens, stores them encrypted on the connection, and redirects back to the
plugin’s admin page. See wp-config: OAuth redirects
for how the redirect URI itself is chosen.
Keys the admin UI’s Settings screen shows: from_email, from_name, default_connection_id,
fallback_connection_id, simulation_enabled, log_emails, log_retention_days. Keys it does not
show, that PUT /settings still accepts:
Key
Default
Meaning
health_check_enabled
true
Probe every active connection on a schedule.
health_check_interval
15
Minutes between probes (1–1440).
oauth_refresh_enabled
true
Refresh OAuth tokens before they expire.
oauth_refresh_interval
15
Minutes between refresh runs (1–1440).
oauth_refresh_max_retries
3
Attempts per token before the failure is reported (1–10).
Other SMTP plugins found on the site (?counts=false skips row counts).
POST
/tools/migration/import
Assess (dry_run) or import a plugin’s connections and one chunk of its log.
POST /tools/migration/import (MigrationImportRequest): source (required — the same ids as
wp boolean-smtp import), dry_run, import_connections (default true),
import_logs (default false; one chunk of 200 rows per call — repeat until logs.done),
max_logs (0–20000), restart_logs, retention_days (dry run only). Response: connections (each
with status of ready, needs_password, needs_authorization, needs_review or unsupported,
plus missing, issues, conversion, was_default, connection_id, masked settings), logs
(available, reason, total, imported, skipped, cursor, done), suggestions, errors.
422 for an unknown or unavailable source.
The only public route in the plugin. Every call is verified against a secret stored on the
provider’s connection before it touches a log row: SendGrid (ECDSA signature over
timestamp + body), Mailgun (HMAC-SHA256 of timestamp + token), Postmark (HTTP basic auth
password). Amazon SES arrives on the same route through its SNS handler
(boolean_smtp_pro_webhook_ses). 401 when no secret is configured or the signature does not
verify; a verified event updates the matching log’s status and fires
boolean_smtp_pro_webhook_received.
