Everything here is ordinary WordPress. There is no separate API to authenticate against, no hosted service holding your data, and no build step — the plugin runs on your server and talks only to the AI provider whose key you entered (and to Supabase, if you enabled it).
REST routes
Every route lives under the chatflint/v1 namespace, at /wp-json/chatflint/v1/….
| Group | Routes | Who may call them |
|---|---|---|
| Chat | ask, session-token, availability, rate, message-feedback, transcript, email-transcript, history-status, upload-attachment, shopping-event | Public, same origin |
| Leads and handoff | save-lead, request-handoff, handoff-status, handoff-messages | Public, same origin |
| Privacy | request-deletion, confirm-deletion | Public; the confirmation link carries its own signed token |
| Agent | admin-reply, resolve-handoff, pending-handoff-count, process-deletion | manage_options |
| Knowledge | documents, entry, train-text, train-document, delete-document, import-qa, preview-chunks, test-question, scan-overlaps, overlap-results, delete-overlap-entry, kb-reset-preview, kb-reset | manage_options |
whatsapp — GET verifies the webhook, POST receives messages | Meta, checked against your app secret |
Public routes are refused when an Origin header names another site. Visitor forms additionally carry a hidden honeypot field and a signed minimum-think-time token from session-token, which is never page-cached.
Streaming
Streaming replies do not go through the REST API. stream.php in the plugin folder is a standalone endpoint that loads wp-load.php itself, because WordPress’s own request lifecycle buffers output. It sends its own SSE headers, including X-Accel-Buffering: no, and pads the first bytes to push past proxy buffers. On Apache the shipped .htaccess turns output buffering off; nginx ignores that file and normally needs nothing. System Health probes the endpoint, and if it is unreachable the widget falls back to ordinary non-streaming replies.
Scheduled tasks
| Hook | When it runs |
|---|---|
ai_chatbot_cleanup_cache | Daily — cache cleanup and the stale-handoff resolver |
ai_chatbot_retention_event | Daily — data-retention deletion |
ai_chatbot_freshness_event | Daily — the content freshness sweep |
ai_chatbot_auto_sync_event | Every five minutes, while auto-sync is on |
ai_chatbot_crawl_worker | One-shot, while a crawl is in progress |
Filters
The extension points that exist on purpose, all used with the usual add_filter.
| Filter | What it changes |
|---|---|
ai_chatbot_providers | The provider registry — add an OpenAI-compatible endpoint of your own |
ai_chatbot_temperature | Sampling temperature for chat calls |
ai_chatbot_pre_provider_call, ai_chatbot_pre_stream_call | Short-circuit or rewrite a provider request |
ai_chatbot_allowed_origins | Extra origins allowed to call the public routes |
ai_chatbot_trusted_proxies | Which proxy headers the client-IP resolver believes |
ai_chatbot_answer_cache_threshold, ai_chatbot_answer_cache_max | How close a cache match must be, and how many entries are kept |
ai_chatbot_history_msg_chars | How much of each earlier message is sent as context |
ai_chatbot_extract_post_text | The text extracted from a post before chunking |
ai_chatbot_crawl_skip_archives, ai_chatbot_crawl_sslverify, ai_chatbot_allow_internal_crawl | Crawler behaviour |
ai_chatbot_shop_excluded_categories | Product categories the shopping assistant may not recommend |
ai_chatbot_lead_notification_subject, ai_chatbot_lead_notification_body | The lead notification email |
ai_chatbot_update_url | Where update checks are made |
ai_chatbot_wa_graph_version | The Meta Graph API version used for WhatsApp |
There is one action, ai_chatbot_shop_finish, fired after a shopping answer has been parsed.
Constants
AI_CHATBOT_VERSION— the running version.AI_CHATBOT_UPDATE_URL— define it inwp-config.phpto point update checks somewhere else, or define it asfalseto switch update checks off on that site.
Database
Tables are created on activation and migrated on upgrade, all under your table prefix: ai_knowledge, ai_conversations, ai_conversation_meta, ai_query_cache, ai_answer_cache, ai_leads, ai_handoff_messages, ai_ratings, ai_knowledge_gaps, ai_sync_queue, ai_crawl_queue, ai_documents, ai_deletion_requests, ai_usage, ai_products and ai_shop_events. Settings are ai_chatbot_* options; secrets are stored write-only and never sent back to a browser.