Update form shortcode

POST

/wp-json/wp2tutor-forms/form/v1/updateShortcode

curl --request POST \
  --url https://example.com/wp-json/wp2tutor-forms/form/v1/updateShortcode \
  --header 'Content-Type: application/json' \
  --header 'X-WP-Nonce: <X-WP-Nonce>' \
  --data '{ "id": 42, "token": "a1b2c3d4e5f60718293a4b5c6d7e8f90", "shortcode": "{\"fullPage\":false,\"width\":\"\",\"height\":\"\",\"css\":\"\"}" }'

Saves the form embed in post meta shortcode. This is not the definition and not runner styles: only the shortcode JSON string. id, token, and shortcode (sanitize_text_field) are required. PHP stores the string in meta as-is when a string is sent. Typical keys after form creation: fullPage, width, height, css. JSON is not validated here (invalid_json is not used on this route). token is the same optimistic lock as updateDefinition: empty/"0" is 400 empty_token; a stale md5 is 400 invalid_token. The response is a new token (shortcode is part of the md5). Requires edit_post. Cookie + X-WP-Nonce or Application Password.

Authorizations

• cookie
• applicationPassword

Request Body^required

Media typeapplication/json

object

id

required

ID of the wp2tutor_form CPT post. Required. Missing post is 404 post_not_found; other type is 400 invalid_post_type.

integer

token

required

Current form snapshot md5. Required. Empty/"0" is empty_token; mismatch is invalid_token.

string

shortcode

required

JSON string for the form embed. Required, sanitize_text_field. PHP writes meta shortcode without json_decode. Typical keys after create_new: fullPage (bool), width, height, css (strings). invalid_json is not used here.

string

Example

{
  "id": 42,
  "token": "a1b2c3d4e5f60718293a4b5c6d7e8f90",
  "shortcode": "{\"fullPage\":false,\"width\":\"\",\"height\":\"\",\"css\":\"\"}"
}

Responses

200

Shortcode saved. Body is the new token after writing meta.

Media typeapplication/json

object

token

required

New optimistic-lock token after a successful write. PHP: md5(definition_json + runner + json(styles) + json(l10n) + json(hooks) + json(trackers) + json(shortcode)). The client sends it on the next update*. Not a magic-link secret and not an Application Password.

string

Example

{
  "token": "0f5a3c9e1b7d2468ace0f13579bdf246"
}

400

Invalid_post_type — post is not CPT wp2tutor_form; invalid_id — same check in the id arg; empty_token — token is empty or "0"; invalid_token — token does not match the snapshot md5; rest_missing_callback_param — id, token, or shortcode is missing.

Media typeapplication/json

object

code

WP_Error code for this API (invalid_token, empty_token, invalid_json, invalid_runner, invalid_permissions, post_not_found, and so on).

string

message

Human-readable text from PHP (Invalid token: generated "…", expected "…", Token cannot be empty., Invalid JSON., etc.).

string

data

Usually { status: HTTP code } on WP_Error from these controllers.

object

Example^generated

{
  "code": "example",
  "message": "example",
  "data": {}
}

401

Not authenticated. WordPress REST: rest_not_logged_in / rest_forbidden. Use cookie + X-WP-Nonce or Application Password.

Media typeapplication/json

object

code

WP_Error code for this API (invalid_token, empty_token, invalid_json, invalid_runner, invalid_permissions, post_not_found, and so on).

string

message

Human-readable text from PHP (Invalid token: generated "…", expected "…", Token cannot be empty., Invalid JSON., etc.).

string

data

Usually { status: HTTP code } on WP_Error from these controllers.

object

Example^generated

{
  "code": "example",
  "message": "example",
  "data": {}
}

403

Invalid_permissions — no edit_post capability on the form post. WordPress REST: rest_forbidden / rest_cookie_invalid_nonce.

Media typeapplication/json

object

code

WP_Error code for this API (invalid_token, empty_token, invalid_json, invalid_runner, invalid_permissions, post_not_found, and so on).

string

message

Human-readable text from PHP (Invalid token: generated "…", expected "…", Token cannot be empty., Invalid JSON., etc.).

string

data

Usually { status: HTTP code } on WP_Error from these controllers.

object

Example^generated

{
  "code": "example",
  "message": "example",
  "data": {}
}

404

Post_not_found — no post with that id; entity_not_found — FormPost did not find the post in the service.

Media typeapplication/json

object

code

WP_Error code for this API (invalid_token, empty_token, invalid_json, invalid_runner, invalid_permissions, post_not_found, and so on).

string

message

Human-readable text from PHP (Invalid token: generated "…", expected "…", Token cannot be empty., Invalid JSON., etc.).

string

data

Usually { status: HTTP code } on WP_Error from these controllers.

object

Example^generated

{
  "code": "example",
  "message": "example",
  "data": {}
}