Trigger a security audit for a WordPress plugin by its wp.org slug. Optionally pass engines: ['performance'] for extended performance analysis (+1 token). Submits to the job queue and polls until complete (up to 20 minutes). Returns the full audit summary.

Audit a WordPress plugin from a local ZIP file. Provide the absolute or relative path to the .zip file. Submits to the job queue and polls until complete (up to 20 minutes). Returns the full audit summary.

Audit all plugin ZIP files in a local directory. Submits in batches of 10 via the job queue, streams results as each audit completes, and prints a summary table. Useful for auditing an entire plugin suite at once.

Check the status of a queued or in-progress audit job. Returns status (queued/processing/complete/failed), queue position, progress, and the audit result when complete.

Get the status and results of a completed audit by its audit ID. Use get_job_status to check a job's progress instead.

Get paginated findings from an audit, optionally filtered by severity or category.

Get AI-ready fix prompts for an audit's findings, batched by severity.

Get the full Fix Plan for an audit — every finding with impact, remediation guidance, test steps, confidence, and agent-safety flags. Premium-tier audits may include refactorPlan: systemic refactor plans that eliminate a whole class of bug in one coordinated change (do those first). JSON (default) or Markdown.

Look up a plugin's latest security grade, risk level, and findings count from the WP HealthKit directory.

Check your current usage — audits used this month, tier, and limits.

Flag a specific finding in an audit as a false positive. The report goes to the WP HealthKit team for review — confirmed patterns result in a scanner rule update preventing this finding in future audits.

Generate a CycloneDX or SPDX Software Bill of Materials (SBOM) for a completed audit. Required for EU Cyber Resilience Act (CRA) compliance. Returns the SBOM JSON.

Get aggregated telemetry statistics for a plugin — active installs, version distribution, WP/PHP version breakdown, locale spread, error rates, and daily trend. Requires that your API key is scoped to the plugin or you have a verified plugin claim.