Introduction and authentication

The Notiwoo plugin exposes a REST API under the notiwoo/v1 namespace. The NOTIWOO app uses it for orders, catalog, extras, operations, tables and loyalty, and you can use it for your own integrations.

This reference covers notiwoo-plugin 1.29.0. Check the installed version with GET /status or in Notiwoo → Dashboard.

Example domains

All examples use https://tienda.example.test and made-up data. To test without touching a real store, use the local test environment, with base URL http://127.0.0.1:8096/wp-json/notiwoo/v1.

Base URL

https://tienda.example.test/wp-json/notiwoo/v1

If the site uses plain permalinks, use https://tienda.example.test/?rest_route=/notiwoo/v1/....

The version is part of the route (v1). There is no version header or negotiation.

Check the installation

GET /status is public and requires no authentication. Call it before anything else to check the plugin version and whether the store accepts orders.

curl https://tienda.example.test/wp-json/notiwoo/v1/status

{
  "success": true,
  "data": {
    "plugin": "notiwoo-plugin",
    "version": "1.29.0",
    "namespace": "notiwoo/v1",
    "coexistence_mode": false,
    "accepting_orders": true,
    "time": "2026-09-30T12:15:00-05:00"
  }
}

Field	Meaning
version	Installed plugin version. Compare it with the compatibility table.
coexistence_mode	true while a WooFood plugin is still active. See coexistence mode.
accepting_orders	If false, do not call POST /orders.
time	Site time in ISO 8601, using the WordPress time zone.

Authentication

Permissions are based on WordPress users and capabilities, so any method that identifies the user to WordPress works.

Method	How it is sent	When to use it
Notiwoo Bearer token	Authorization: Bearer <token>	Mobile apps and custom clients. Recommended.
WordPress application password	Authorization: Basic base64(username:application-password)	Server integrations and the connection with the NOTIWOO app.
Cookie + nonce	Signed-in session and X-WP-Nonce header	JavaScript inside wp-admin (used by the plugin screens).

The old WooFood Username and Password headers are no longer supported.

Bearer token

Request a token with the WordPress username (or email) and password:

curl -X POST https://tienda.example.test/wp-json/notiwoo/v1/auth/token \
  -H "Content-Type: application/json" \
  -d '{"username": "gerente@example.test", "password": "example-password"}'

{
  "success": true,
  "data": {
    "token": "Q3xY7mV2nB8kL1pZ5rT9wE4uI6oA0sD2fG7hJ3kL8zX1cV5bN9mQ2wE6rT4yU0iO",
    "token_type": "Bearer",
    "expires_at": 1793793600,
    "user": { "id": 7, "username": "gerente", "roles": ["shop_manager"], "capabilities": { "manage_woocommerce": true } }
  }
}

• The token has 64 characters and lasts 30 days from issue. Using it does not extend it and there is no refresh route: when it expires, request a new one.
• expires_at is a Unix timestamp in seconds.
• Each sign-in creates a new token, so the same user can have several devices connected.
• The token is shown only once. The plugin stores a hash, never the original value.
• DELETE /auth/token revokes the token used in the request. Call it on sign-out.
• If the request arrives with a cookie session, the cookie takes precedence over the token.

Servers that strip the Authorization header

Some Apache or CGI servers do not pass the Authorization header to PHP. If you get 401 with a valid token, add the rule SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1 to .htaccess, or ask your hosting provider to set it up.

Application password

Create it in Users → Profile → Application Passwords for an administrator or shop manager account. WordPress requires HTTPS to use them, except in local environments.

curl -u "gerente:abcd efgh ijkl mnop qrst uvwx" \
  https://tienda.example.test/wp-json/notiwoo/v1/auth/me

Permissions

Each route requires one of these levels:

Level	Who
Public	Anyone, without authentication.
Signed in	Any authenticated user, including customers.
Management	Users with the manage_woocommerce capability: administrator and shop manager.
Management or store	manage_woocommerce or the multistore_user role (legacy multi-store add-on).

Without authentication, protected routes respond 401 notiwoo_unauthorized. With a user who lacks permission, they respond 403 notiwoo_forbidden. Each page in this section shows the level of each route.

Response format

Successful responses use this envelope:

{ "success": true, "data": {}, "meta": {} }

• data contains the resource or the list.
• meta appears only when it has content, for example pagination.
• The HTTP status is 200, or 201 when a resource is created.

Errors come in two possible formats. See Errors.

Pagination

Lists accept page (from 1) and per_page (20 by default, maximum 100). Page information arrives in meta:

"meta": { "page": 1, "per_page": 20, "total": 57, "total_pages": 3 }

The API does not send the X-WP-Total, X-WP-TotalPages or Link headers. Always read meta. Exceptions are noted on each resource.

Headers

Header	Direction	Use
Authorization	Request	Bearer token or application password.
X-WP-Nonce	Request	Cookie authentication.
X-Notiwoo-Actor: notifier:<id>	Request, optional	Records who made a change in the loyalty history. Accepted only from users with manage_woocommerce.
Cache-Control: private, no-store	Response	On all table and loyalty routes.

Idempotency and concurrency

Some operations accept a key so that a retry does not duplicate the change:

Operation	Field	Format
Bulk changes	request_id	8 to 64 characters A-Z a-z 0-9 _ -
Redeem points	idempotency	8 to 80 characters A-Z a-z 0-9 _ : -
Adjust points	idempotency	8 to 64 characters A-Z a-z 0-9 _ -

If you repeat the request with the same key, you get the original result. Operations that cannot run in parallel (a table, a points account, a bulk change) respond 409 when another one is already in progress. Wait and retry.

Limits and CORS

• The plugin does not apply rate limits. Protect the public access routes (/auth/token, /auth/register, /auth/reset-password) with your firewall or hosting.
• There is only one built-in limit: loyalty verification emails, one per minute per account.
• The plugin does not change the WordPress CORS policy. If you call the API from a browser on another domain, configure CORS on the server.

Message language

Messages (message) are returned in the site language: Spanish, or English since 1.29.0. Never base logic on the text: use the code field.

Coexistence mode

While a WooFood plugin is still active:

• All routes remain registered.
• POST /orders responds 409 notiwoo_cutover_pending.
• Tables and loyalty appear disabled.
• The old woofood/* routes are still served by the previous plugin.

See Migrate from WooFood.

Resources

Resource	Page
Access, customer account and addresses	Accounts and customers
Orders and statuses	Orders
Service modes, hours, delivery and cart validation	Hours, delivery and cart
Products, availability and categories	Catalog
Extras, extra categories and assignments	Extras
Bulk changes with preview and undo	Bulk changes
Operations, appearance and category menu	Settings
Table service and QR	Tables
Points, rewards and program	Loyalty
Couriers, payments and shipping	Store operations
Custom statuses, webhooks, metadata and checkout	WooCommerce integration