WP Support Agent Documentation

All routes sit under the wp-support-agent/v1 namespace.

Public — unauthenticated by design, because a visitor is not a logged-in user. Every one is protected by a signed session cookie, a same-origin check, a per-visitor rate limit and the site-wide daily cap.
POST /chat — send a message; streams by default, pass stream=false for a single JSON reply
GET /history — messages in the current session
POST /reset — start a new session
POST /rate — thumb rating on one reply
POST /escalate — hand off to a person (Pro)

Admin — all require manage_options and a valid REST nonce.
POST /admin/models — list models from the configured provider
POST /admin/test — verify the API key against the live service
POST /admin/scan — run or resume a knowledge base scan
POST /admin/agentpress — trigger AgentPress MD generation
POST /admin/save — persist settings

wpsa_is_pro — the master feature gate; Pro narrows it further so an expired licence stops unlocking features immediately
wpsa_system_prompt — the assembled system prompt before it is sent
wpsa_retrieve_context — the passages retrieved for a question
wpsa_providers — the provider registry
wpsa_presets — appearance presets
wpsa_avatars — the built-in avatar set
wpsa_sources — registered content sources
wpsa_make_transport — swap the HTTP transport
wpsa_should_render — whether the widget renders on this request
wpsa_can_stream — allow or block streaming
wpsa_allowed_origins — extra origins accepted by the same-origin check
wpsa_client_ip — how the visitor IP is derived before hashing
wpsa_purge_cache — override the page cache purge
wpsap_license_api_url — point Pro at a different licence server

wpsa_loaded — the free plugin has booted; Pro hooks this, so an add-on is inert without it
wpsap_loaded — the Pro add-on has booted
wpsa_purged_caches — fired after page caches are cleared
wpsap_escalated — fired after a successful handoff, for CRM or helpdesk integrations

Three tables, all prefixed like the rest of your install. Schema version 1.2.0, tracked in the wpsa_db_version option.

wpsa_sessions — one row per conversation: session key, hashed visitor, user id, page URL, locale, message count, rating, resolved flag, timestamps
wpsa_messages — one row per message: role, content, raw payload, model, input and output token counts, per-reply rating
wpsa_chunks — the knowledge base: entry and source ids, sequence, title, URL, body, priority and enabled flags, plus the FULLTEXT index over title and body

Visitor IP addresses are never stored. visitor_hash is a salted hash used only for rate limiting, which is what lets the plugin throttle abuse without keeping personal data.

wpsa_purge_conversations — daily; deletes conversations older than retention_days
wpsa_scan_batch — indexes the knowledge base in batches

Options written: wpsa_settings, wpsa_version, wpsa_db_version, wpsa_license, wpsa_scan_queue, wpsa_scan_state, wpsa_error_log. API keys are stored separately and encrypted by WPSA_Credentials, using a key derived from your site’s security salts.

Deleting the plugin through the WordPress admin runs uninstall.php, which is deliberately thorough: it drops all three tables, purges the encrypted credentials, deletes every option listed above, removes all wpsa_kb entries and their wpsa_kb_group terms, and clears the scheduled events.

Deactivating does none of this — it only unschedules the cron events. If you want to keep your knowledge base and conversation history, deactivate rather than delete.