FOR INTEGRATORS

Build against the CodeOn API

Reference for the small set of public REST endpoints CodeOn plugins call, the Bank of Georgia webhook contract, and the internals of how licenses, watermarks, and tamper detection work. Useful if you're extending a CodeOn plugin, writing your own, or building a marketplace integration.

API reference

The plugin-facing endpoints. All responses are JSON; license-related responses carry a signature so the plugin can verify payloads end-to-end.

POST /api/v1/validate-license
The heartbeat WordPress plugins call once per day. Request shape, signed response, status enum (active / grace / expired / suspended), grace-period contract.
Open
GET /api/v1/updates/<plugin>
Update manifest the WP UpdateChecker reads. Per-plugin tag resolution, version compare rules, force-refresh hints.
Open
POST /api/v1/tamper-report
Daily silent heartbeat from a watermarked plugin when its build-stamp fails to verify. Best-effort, fire-and-forget.
Open

Webhooks

Inbound callbacks CodeOn receives from upstream gateways and turns into local order state.

Bank of Georgia callbacks
Signed callbacks BoG sends for created → processing → completed (and refund / rejected). Signature verification, event ordering, replay protection.
Open

Plugin internals

The contracts a CodeOn plugin honours so license validation, updates, and tamper detection work end-to-end.