It's All Stack · CLI Reference
The suite is built to be driven by something other than a person. This page is the short version of how to do that without breaking a store.
The suite deliberately exposes the same service layer through three adapters: WP-CLI, the REST endpoints, and the WordPress Abilities API. They are adapters, not three implementations — a fix in the service layer lands in all three at once, and no adapter can do something the others cannot see.
For an agent the CLI is usually the right one. It is JSON-first, it has no authentication handshake to negotiate (its trust boundary is the shell it already has), every mutation can be previewed with --dry-run before it is committed, and everything it does lands in an audit log a human can read afterwards.
Read before you write. Every group has inspect, list and show; resolve the exact record first rather than acting on a guess. Always dry-run first. Pass --format=json and parse the result rather than scraping the table. Never pass --yes speculatively — it is the confirmation, and on an irreversible command it is the only thing standing between a mistake and a restore from backup.
| Artifact | Shape | Use it for |
|---|---|---|
cli-spec.json | JSON, self-describing (carries its own $schema) | Enumerating the surface: one entry per command with its options, types, examples and whether it is destructive. This is the file to load into a tool definition. |
LLM-REFERENCE.md | Markdown, bullet options | Dropping into a prompt. One per plugin, linked from each command page and bundled in the zip. |
CLI.md | Markdown, table options | Human reading in the repo or the zip; the same content as these pages. |
wp ias <group> <cmd> --help | Terminal | The source all of the above are generated from, so it can never disagree with them. |
Each of these is a real sequence against real commands. Substitute your own IDs; the --dry-run step is not decorative.
Confirm the product is one the licence server knows about, preview the issue, then commit it and read the key back.
wp ias license-activator products list --format=json
wp ias license-activator licenses generate 42 --customer=customer@example.com --dry-run
wp ias license-activator licenses generate 42 --customer=customer@example.com --format=json
wp ias license-activator licenses list --customer=customer@example.com --format=jsonAdd --expires="+1 year" for a time-limited key, or --quantity= to issue several at once.
Resolve the key to its owner before touching anything — the answer is usually that it belongs to a different order than the customer thinks.
wp ias serial-keys whose IAS-ABCD-1234-EFGH --format=json
wp ias serial-keys show IAS-ABCD-1234-EFGH --format=json
wp ias serial-keys stock --format=json
wp ias serial-keys assign IAS-ABCD-1234-EFGH customer@example.com --dry-runstock is the check worth running first if several customers report the same thing: an exhausted pool looks exactly like a broken key from the outside.
Read the current state, preview the proration, then apply it.
wp ias subscriptions show 17 --format=json
wp ias subscriptions switch 17 88 --dry-run
wp ias subscriptions switch 17 88 --immediate --yes --format=jsonWithout --immediate the switch takes effect at the next renewal. The dry run reports the resulting status, variation and recurring total, so compare that against what the customer was promised before committing.
Presigned S3 URLs expire by design. Check the credentials are healthy before blaming the link.
wp ias s3-storage verify-credentials --format=json
wp ias s3-storage download-logs --format=json
wp ias s3-storage regenerate-link 1234 --format=jsonThe Single Purchase Enforcer blocks repeat purchases of the same digital product. This is the whole diagnosis:
wp ias single-purchase owned customer@example.com --format=json
wp ias single-purchase owners 42 --format=jsonIf the block is wrong, revoke-ownership is the surgical fix and restore-ownership is its inverse — reach for those rather than purge-customer, which is irreversible.
Subscriptions export to JSON or CSV with the full billing schedule, related orders and meta — a migration source, not a report.
wp ias subscriptions export --file=/tmp/subs.json --dry-run
wp ias subscriptions export --file=/tmp/subs.json --status=active
wp ias serial-keys export --format=csvExports are not licence-gated: leaving is always possible.
Every mutation and every dry run across the whole suite lands in one audit log, not six. That is the first place to look when an agent has been let loose and you want to know what it actually did:
wp ias license-activator audit-log list --format=jsonEntries carry the timestamp, the plugin, the action, the user and a redacted before-state. Licence keys are never written to the log in full.