AJAX actions

RestroPress registers its AJAX handlers through the standard WordPress wp_ajax_{action} and wp_ajax_nopriv_{action} hooks, so every handler is reached with a request to admin-ajax.php. This page lists the 70 actions the core plugin registers, who can call each one, what it checks and what it returns.

How requests work#

• Send a POST (a few handlers read $_GET or $_REQUEST) to admin-ajax.php with an action field. The storefront script receives the URL as rpress_scripts.ajaxurl; admin scripts receive ajaxurl or ajax_url.
• Most handlers verify a nonce. The nonce action differs per handler and is listed in the Security column. It is read from the field named in that column (usually security, sometimes nonce). A failed check_ajax_referer() ends the request with -1 and HTTP 403.
• Storefront nonces are created by the plugin and printed into the page as rpress_scripts properties such as add_to_cart_nonce, service_type_nonce and checkout_nonce; admin nonces are printed into the admin script data.
• Handlers that use wp_send_json_success() or wp_send_json_error() return {"success":true,"data":...} or {"success":false,"data":...}. Handlers that call wp_send_json() or echo wp_json_encode() return the bare object described below.
• An unknown action returns 0 with HTTP 400.

In the tables, Parameters are read from $_POST unless stated. Capability checks use WordPress capabilities; the shop capabilities (manage_shop_settings, edit_shop_payments, view_shop_reports, edit_products, export_shop_reports) belong to the RestroPress shop roles and administrators.

Storefront actions for visitors and logged-in users#

These 27 actions are registered with both wp_ajax_ and wp_ajax_nopriv_. The 24 RP_AJAX events are also hooked to rp_ajax_{event} for the rp-ajax endpoint, which is described further down.

Action	Handler	Security	Parameters	Response	Source
rpress_show_products	RP_AJAX::show_products	Nonce show-products in security.	fooditem_id (required), service_type, selected_date, selected_time; also reads the service_time cookie.	Success: data holds price, price_raw, html, html_title, description, image_url. Error: data holds status (error) and error_msg, for example when the store is closed or no slot is free.	includes/class-rpress-ajax.php
rpress_add_to_cart	RP_AJAX::add_to_cart	Nonce add-to-cart in security.	fooditem_id (required), fooditem_qty (default 1), special_instruction, post_data: array of {name, value} pairs as produced by serializeArray(). A variable-priced item expects the price option ID as the first value; each add-on value is addonId|quantity|price|type.	Bare JSON: the cart totals (subtotal, total, cart_quantity, cart_summary, plus tax and taxes when taxes are on) and cart_item (HTML), cart_key, merged (true when the line was merged into an existing one). Empty body when fooditem_id is missing.	includes/class-rpress-ajax.php
rpress_show_delivery_options	RP_AJAX::show_delivery_options	Nonce service-type in security.	fooditem_id.	Success: html, html_title.	includes/class-rpress-ajax.php
rpress_check_service_slot	RP_AJAX::check_service_slot	Nonce service-type in security.	The whole $_POST array, sanitized and passed to the rpress_check_service_slot and rpress_validate_slot filters.	Bare JSON: the filtered array (or status plus msg for a WP_Error, or status success/error for a scalar) merged with the cart totals (subtotal, total, cart_quantity, cart_summary, plus tax and taxes when taxes are on).	includes/class-rpress-ajax.php
rpress_edit_cart_fooditem	RP_AJAX::edit_cart_fooditem	Nonce edit-cart-fooditem in security.	cartitem_id, fooditem_id, fooditem_name.	Success: price, price_raw, html, html_title, description, image_url, addon_items.	includes/class-rpress-ajax.php
rpress_update_cart_items	RP_AJAX::update_cart_items	Nonce update-cart-item in security.	fooditem_cartkey, fooditem_id, fooditem_qty, special_instruction, post_data (as for add to cart).	Bare JSON: the cart totals (subtotal, total, cart_quantity, cart_summary, plus tax and taxes when taxes are on) and cart_item, cart_key. Empty body when neither a cart key nor an ID is sent.	includes/class-rpress-ajax.php
rpress_cart_item_quantity	RP_AJAX::cart_item_quantity	Nonce update-cart-item in security.	cart_key, quantity. A quantity below 1 removes the line.	Bare JSON: the cart totals (subtotal, total, cart_quantity, cart_summary, plus tax and taxes when taxes are on), cart_item, cart_key, and removed (1) when the line was removed. Error: data.message is invalid_cart_key or invalid_item.	includes/class-rpress-ajax.php
rpress_remove_from_cart	RP_AJAX::remove_from_cart	Nonce edit-cart-fooditem in security.	cart_item.	Bare JSON: removed (1) and the cart totals (subtotal, total, cart_quantity, cart_summary, plus tax and taxes when taxes are on). Empty body when cart_item is missing.	includes/class-rpress-ajax.php
rpress_clear_cart	RP_AJAX::clear_cart	Nonce clear-cart in security.	None. Also deletes the service cookies.	Bare JSON: status (success) and response (empty-cart HTML).	includes/class-rpress-ajax.php
rpress_remove_fees_after_empty_cart	RP_AJAX::remove_fees_after_empty_cart	Nonce clear-cart in security.	None. Clears the cart, fee and resume-payment session values.	Bare JSON: message.	includes/class-rpress-ajax.php
rpress_proceed_checkout	RP_AJAX::proceed_checkout	Nonce proceed-checkout in security.	None.	Bare JSON from rpress_pre_validate_order(), filtered by rpress_proceed_checkout.	includes/class-rpress-ajax.php
rpress_get_subtotal	RP_AJAX::get_subtotal	None.	None.	Plain text: the formatted cart subtotal.	includes/class-rpress-ajax.php
rpress_apply_discount	RP_AJAX::apply_discount	Nonce rpress_checkout_nonce in security. A bad nonce returns a JSON message instead of dying.	code (required), form: serialized checkout form, used to read rpress_email for guests.	Bare JSON. Valid: msg (valid), discount_value, amount, total_plain, total, code, html. Invalid: msg (the error text) and code.	includes/class-rpress-ajax.php
rpress_remove_discount	RP_AJAX::remove_discount	Nonce rpress_checkout_nonce in security.	code.	Bare JSON: total, code, discounts, html. Empty body on a bad nonce or missing code.	includes/class-rpress-ajax.php
rpress_checkout_login	RP_AJAX::checkout_login	Nonce rpress_checkout_nonce in security.	None.	HTML: the login fields (rpress_purchase_form_login_fields).	includes/class-rpress-ajax.php
rpress_checkout_register	RP_AJAX::checkout_register	Nonce rpress_checkout_nonce in security.	None.	HTML: the registration fields (rpress_purchase_form_register_fields).	includes/class-rpress-ajax.php
rpress_recalculate_taxes	RP_AJAX::recalculate_taxes	Nonce rpress_checkout_nonce in security.	billing_country (defaults to the shop country).	Bare JSON: html, tax_raw, tax, tax_rate_raw, tax_rate, total, total_raw. No output when the cart is empty.	includes/class-rpress-ajax.php
rpress_get_states	RP_AJAX::get_states	Nonce rpress_checkout_nonce or rpress_get_states_nonce in security.	country (defaults to the shop country), field_name.	HTML: a <select> of states, or the text nostates.	includes/class-rpress-ajax.php
rpress_fooditem_search	RP_AJAX::fooditem_search	No nonce. Visitors see published items only; users with edit_products also see draft, private and scheduled items.	$_GET: s, current_id (IDs to exclude), variations (boolean).	Bare JSON array of {id, name}, at most 50, or one entry with id 0 and "No results found". Variations appear as {itemId}_{priceId}.	includes/class-rpress-ajax.php
rpress_checkout_update_service_option	RP_AJAX::checkout_update_service_option	Nonce update-service in security.	None.	Success: order_html, cart_html, total_amount (filter rpress_checkout_update_service_option_response).	includes/class-rpress-ajax.php
rpress_checkout_service_fees	RP_AJAX::checkout_service_fees	None.	None.	Success: delivery and pickup, each a fee label string.	includes/class-rpress-ajax.php
rpress_reorder	RP_AJAX::reorder	Nonce show-order-details in security. Then the caller must own the order; guests need a valid payment_key in the request. Failure: HTTP 403.	order_id, and payment_key for guest orders.	Success: html (confirmation markup). Adds every line of the order to the cart. Error: data.message with status 403.	includes/class-rpress-ajax.php
rpress_update_modal_on_service_switch	RP_AJAX::update_modal_on_service_switch	Nonce service-type in security.	service_type ($_REQUEST). Sets the service_type cookie.	Success: modal_html, time_option_html.	includes/class-rpress-ajax.php
rpress_receipt_order_status	RP_AJAX::receipt_order_status	Nonce rpress-receipt-status-{payment_id} in security, and the payment_key must match the order and permit viewing the receipt.	payment_id, payment_key ($_REQUEST).	Success: payment_id, order_number, status, status_label, status_color, updated_at_unix. Error: data.message with 400, 403 or 404.	includes/class-rpress-ajax.php
rpress_process_checkout	rpress_process_purchase_form()	Nonce rpress_checkout_nonce in security or rpress_checkout_nonce.	The checkout form fields, and rpress_ajax. With rpress_ajax set the handler only validates.	With rpress_ajax: the text success, or the error markup. Without it the handler continues, creates the order and sends the customer to the payment gateway.	includes/process-purchase.php:238
rpress_process_checkout_login	rpress_process_purchase_login()	Nonce rpress_checkout_nonce as above.	The checkout login fields and rpress_ajax.	With rpress_ajax: success after logging the user in, or the error markup.	includes/process-purchase.php:311
rpress_load_gateway	rpress_load_ajax_gateway()	Nonce rpress_load_gateway in security.	rpress_payment_mode.	HTML: the payment form of the chosen gateway. Empty on a bad nonce.	includes/gateways/actions.php:42

Account actions for logged-in users#

Registered with wp_ajax_ only.

Action	Handler	Security	Parameters	Response	Source
rpress_show_order_details	RP_AJAX::show_order_details	Nonce show-order-details in security. The user must own the order.	order_id.	Success: html of the order details. Error: 403 with data.message.	includes/class-rpress-ajax.php
rpress_more_order_history	RP_AJAX::more_order_history	Nonce show-order-details in security. Logged in.	None read by the handler; the included history template reads the paging values.	Success: html, found_post. Error: 403.	includes/class-rpress-ajax.php
rpress_delete_user_address	RP_AJAX::delete_user_address	Nonce rpress-user-address in security.	index.	Bare JSON: success (boolean). No output when index is missing.	includes/class-rpress-ajax.php
rpress_default_user_address	RP_AJAX::default_user_address	Nonce rpress-user-address in security.	index. Copies the saved address into the user's name, phone and delivery address.	Bare JSON: success.	includes/class-rpress-ajax.php

Menu item and order editing actions#

Registered with wp_ajax_ only. They serve the menu item editor and the order screens in the admin.

Action	Handler	Security	Parameters	Response	Source
rpress_add_price	RP_AJAX::add_price	Nonce add-price in security. No capability check.	i (row index).	HTML: a variable price row.	includes/class-rpress-ajax.php
rpress_add_addon	RP_AJAX::add_addon	Nonce add-addon in security. No capability check.	i, iscreate (true returns the new add-on category form), item_id.	HTML.	includes/class-rpress-ajax.php
rpress_load_addon_child	RP_AJAX::load_addon_child	Nonce load-addon in security. No capability check.	parent, i, item_id.	HTML: the add-on items table.	includes/class-rpress-ajax.php
rpress_add_category	RP_AJAX::add_category	Nonce add-category in security. No capability check.	name, parent.	Bare JSON from wp_insert_term(): term_id and term_taxonomy_id, or the serialized WP_Error. Creates a food-category term.	includes/class-rpress-ajax.php
rpress_check_for_fooditem_price_variations	RP_AJAX::check_for_fooditem_price_variations	Capability edit_products; no nonce. Without it the request ends with -1.	fooditem_id.	HTML: a price dropdown or a price input.	includes/class-rpress-ajax.php
rpress_admin_order_addon_items	RP_AJAX::admin_order_addon_items	Nonce load-admin-addon in security.	fooditem_id, price_id, format (json or HTML).	With json: success with groups. Otherwise HTML.	includes/class-rpress-ajax.php
rpress_get_order_details	RP_AJAX::get_order_details	check_admin_referer rpress-preview-order in security; capability edit_shop_payments on the order (403 page otherwise).	$_GET order_id.	Success: the data used by the order preview. Error: 400 for a missing ID.	includes/class-rpress-ajax.php
rpress_update_order_status	RP_AJAX::update_order_status	check_admin_referer rpress-order in security; capability edit_shop_payments on the order.	payment_id, status ($_REQUEST), redirect ($_GET).	Bare JSON: success, payment_id, status, status_label, force_reload, redirect. With redirect set, redirects instead. An unknown status returns success false.	includes/class-rpress-ajax.php
rpress_check_new_orders	RP_AJAX::check_new_orders	Capability edit_shop_payments (filter rpress_check_new_orders_cap), then nonce rpress-check-new-orders in security.	None.	Bare JSON notification: title, body, icon, sound, url. Empty body when there is no new order. Each call stores the newest order ID site-wide.	includes/class-rpress-ajax.php
rpress_customer_search	RP_AJAX::customer_search	Capability view_shop_reports (filter rpress_view_customers_role); no nonce.	$_GET s.	Bare JSON array of {id, name} (name includes the email), at most 50, or one entry with id 0.	includes/class-rpress-ajax.php
rpress_user_search	RP_AJAX::user_search	Capability view_shop_reports (filter rpress_view_users_role); no nonce.	$_GET s.	Bare JSON array of {id, name} (display name), at most 50.	includes/class-rpress-ajax.php
rpress_search_users	RP_AJAX::search_users	Capability manage_shop_settings; no nonce. No output without it.	user_name, exclude (comma-separated user IDs).	Bare JSON: results, an HTML list of user logins.	includes/class-rpress-ajax.php
rpress_activate_addon_license	RP_AJAX::activate_addon_license	Nonce activate-license in security, then capability manage_shop_settings (403).	license_key (option name, must end with _license), license, item_id, product_name.	Bare JSON: status (updated or error) and message. Calls the licence server at restropress.com.	includes/class-rpress-ajax.php
rpress_deactivate_addon_license	RP_AJAX::deactivate_addon_license	Nonce deactivate-license in security, then capability manage_shop_settings.	license_key, product_name.	Bare JSON: status, message.	includes/class-rpress-ajax.php

Admin screen actions#

Registered with wp_ajax_ only, in separate classes and files.

Action	Handler	Security	Parameters	Response	Source
rpress_load_dashboard_widget	rpress_load_dashboard_sales_widget()	Capability view_shop_reports (filter rpress_dashboard_stats_cap); no nonce.	None.	HTML of the dashboard sales widget.	includes/admin/dashboard-widgets.php:194
rpress_command_center_refresh	RPRESS_Command_Center_Dashboard::ajax_refresh()	Nonce rpress-command-center in nonce (a bad nonce returns 403 with data.code expired), then capability view_shop_reports.	None.	Success: html, updated, health.	includes/admin/dashboard/class-rpress-command-center-dashboard.php:23
rpress_live_orders_refresh	RP_Live_Orders::ajax_refresh()	Nonce rp_live_orders_refresh in security, then capability edit_shop_payments.	known_order_ids (array or comma list).	Success: polled_at, columns, all_order_ids, kpis, new_order_ids.	includes/admin/payments/class-live-orders.php:27
selected_filter	RP_Admin_Assets::selected_filter()	Capability view_shop_reports (filter rpress_dashboard_stats_cap), then nonce selected-filter in nonce.	date (today, yesterday, last_week, last_month, this_year, last_year, custom), startDate, endDate.	Bare JSON: order_count, customer_count, total_refund, total_sales and the four *_percentage values.	includes/admin/class-rp-admin-assets.php:39
order_graph_filter	RP_Admin_Assets::order_graph_filter()	Capability as above, then nonce rpress-admin-reports in nonce.	select_filter: weekly, monthly or yearly.	Bare JSON object of order counts keyed by day (01) or month. Empty array for any other value.	includes/admin/class-rp-admin-assets.php:41
revenue_graph_filter	RP_Admin_Assets::revenue_graph_filter()	Capability as above, then nonce rpress-admin-reports in nonce.	select_filter: weekly, monthly or yearly.	Bare JSON object of paid-order totals keyed by day or month.	includes/admin/class-rp-admin-assets.php:42
customers_data_filter	RP_Admin_Assets::customers_data_filter()	Capability as above, then nonce rpress-admin-reports in nonce.	selected_option: weekly, monthly (default) or yearly.	Bare JSON: customer_count, customer_percentage, customer_count_last.	includes/admin/class-rp-admin-assets.php:43
rpress_toggle_availability	rpress_availability_ajax_toggle()	Nonce rp_availability_toggle in nonce, then edit_post on the item.	item_id, status (available or unavailable).	Success: status. Error: 400 or 403 with message.	includes/admin/fooditems/availability.php:285
rpress_save_bulk_edit	rpress_save_bulk_edit()	Nonce rpress-bulk-edit in rpress_bulk_nonce, capability edit_products, and edit_post for each ID.	post_ids, price.	No body. Sets the price of every listed item.	includes/admin/fooditems/dashboard-columns.php:342
rpress_insert_payment_note	rpress_ajax_store_payment_note()	Nonce rpress-payment-note in security; capability edit_shop_payments on the order.	payment_id, note.	HTML of the new note, or -1 when an ID or note is empty.	includes/admin/payments/actions.php:398
rpress_delete_payment_note	rpress_ajax_delete_payment_note()	Nonce rpress-payment-note in security; capability edit_shop_payments.	payment_id, note_id.	1 on success, -1 on failure.	includes/admin/payments/actions.php:435
rp_print_payment_data	RPRESS_Print_Receipts::rp_print_payment_data()	check_ajax_referer rpress-order in security; capability edit_shop_payments on the order.	$_GET payment_id.	HTML of the printable receipt.	includes/class-rpress-print-receipts.php:27
rpress_trigger_upgrades	rpress_trigger_upgrades()	Capability manage_shop_settings; no nonce.	None.	Runs the version upgrade routines and prints complete.	includes/admin/upgrades/upgrade-functions.php:51
rp_update_category_order	RP_Food_Category_Sorting::update_category_order()	Nonce term_order_nonce in term_order_nonce; no capability check. A bad nonce returns {"success":false}.	taxonomy_ordering_data (list of {term_id, order}), base_index.	Success: updated (count). Error when nothing was updated.	includes/class-rpress-category-sorting.php:17
rp_get_category_order	RP_Food_Category_Sorting::rp_get_category_order()	Nonce term_order_nonce in term_order_nonce.	None.	Success: object of category term ID to position.	includes/class-rpress-category-sorting.php:18
rp_update_addon_category_order	RP_Addon_Sorting::update_category_order()	Nonce term_order_nonce in term_order_nonce; no capability check.	taxonomy_ordering_data, base_index.	Success with no data.	includes/admin/class-rp-addon-sorting.php:20
rp_get_addon_category_order	RP_Addon_Sorting::rp_get_category_order()	Nonce term_order_nonce in term_order_nonce.	fooditem_id.	Success: object of add-on category term ID to position.	includes/admin/class-rp-addon-sorting.php:21

Onboarding actions#

All six use the same check: capability first (manage_shop_settings for the first, edit_products for the others, otherwise 403), then nonce rpress_onboarding in nonce. Source: includes/admin/home/class-rpress-onboarding.php, class RPress_Onboarding.

Action	Handler	Security	Parameters	Response	Source
rpress_onboarding_save_step	ajax_save_step	Capability manage_shop_settings; nonce.	step (welcome, profile, appearance, ordering, hours, payments, operations, menu, ai, launch), data, next_step.	Success: state, ai_status.	includes/admin/home/class-rpress-onboarding.php:28
rpress_onboarding_upload_menu	ajax_upload_menu	Capability edit_products; nonce.	consent (must be yes), file menu_file (pdf, jpg, jpeg, png, webp, csv, xls, xlsx; at most 10 MB).	Success: job_id, status, payload, html for review. Errors use 400 with message.	includes/admin/home/class-rpress-onboarding.php:29
rpress_onboarding_publish_menu	ajax_publish_menu	Capability edit_products; nonce; the user must own the import job.	job_id, job_ids (JSON), mode (draft or publish), payload (JSON).	Success: message, result, state.	includes/admin/home/class-rpress-onboarding.php:30
rpress_onboarding_publish_items	ajax_publish_items	Capability edit_products; nonce.	payload (JSON with categories), mode, is_sample.	Success: result, message. Error 400 or 500.	includes/admin/home/class-rpress-onboarding.php:31
rpress_onboarding_delete_import	ajax_delete_import	Capability edit_products; nonce; job ownership.	job_id.	Success: message.	includes/admin/home/class-rpress-onboarding.php:32
rpress_onboarding_test_ai	ajax_test_ai	Capability edit_products; nonce.	data (AI provider settings, saved before testing).	Success: message, status. Error 400 with title, message, steps, error_code.	includes/admin/home/class-rpress-onboarding.php:33

Export and import actions#

Action	Handler	Security	Parameters	Response	Source
rpress_do_ajax_export	rpress_do_ajax_export()	Nonce rpress_ajax_export inside the serialized form field; the batch class must extend RPRESS_Batch_Export and the user must pass can_export() (export_shop_reports). Failure: -2 or -1.	form (serialized, includes rpress-export-class), step.	Bare JSON: step and percentage; error and message; success and message; or step done with a download url.	includes/admin/reporting/export/export-functions.php:95
rpress_do_ajax_import	rpress_do_ajax_import()	Nonce rpress_ajax_import in nonce; the import class's can_import().	class, upload[file], step, mapping (URL-encoded field mapping).	Success: step, percentage, columns, mapping, total, or step done with message. Error: error.	includes/admin/import/import-functions.php:138

The rp-ajax endpoint#

RP_AJAX also defines a front-end endpoint: a request to /?rp-ajax={event} is meant to fire rp_ajax_{event} for the 24 storefront events listed above, then end. RP_AJAX::get_endpoint( $request ) builds the URL and the rp_ajax_get_endpoint filter can change it.

Notes. In 3.4.11 any request that includes the rp-ajax query parameter ends in a PHP fatal error (HTTP 500), because define_ajax() calls rp_maybe_define_constant() and rp_nocache_headers(), which are not defined. Use admin-ajax.php instead; the plugin's own scripts do.

Calling an action from JavaScript#

This example adds a menu item to the cart from a page that has the RestroPress storefront scripts. It uses the nonce that the plugin prints in rpress_scripts and the add-on value format described above.

const body = new URLSearchParams();
body.set('action', 'rpress_add_to_cart');
body.set('security', rpress_scripts.add_to_cart_nonce);
body.set('fooditem_id', '14');
body.set('fooditem_qty', '2');
body.set('special_instruction', 'No butter');

fetch(rpress_scripts.ajaxurl, {
  method: 'POST',
  credentials: 'same-origin',
  headers: { 'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8' },
  body
})
  .then((response) => response.json())
  .then((cart) => {
    console.log(cart.cart_key, cart.subtotal, cart.cart_quantity);
  });

For actions that return wp_send_json_success(), read response.data and check response.success. Send credentials: 'same-origin' so the cart session cookie travels with the request.

Notes#

• Several editor actions (rpress_add_price, rpress_add_addon, rpress_load_addon_child, rpress_add_category and the two term-order updates) check only a nonce and no capability. Anyone who obtains one of those nonces can call them.
• rpress_show_order_details and the address actions are registered for logged-in users only, so the guest branch of the order-access check cannot be reached through admin-ajax.php; rpress_reorder is the one account action that visitors can call.
• rpress_do_ajax_export is registered twice (a function and a method of RP_Admin_Assets); the function always ends the request, so the method never runs.
• rpress_do_ajax_import instantiates the class named in the request before it checks can_import(), and does not restrict the class name the way the export handler does.
• rpress_onboarding_test_ai saves the posted AI provider settings, including API keys, for users who only have edit_products.
• rpress_check_new_orders stores the latest order ID once for the whole site, so with several admins polling only the first one receives a notification.