Base URL: https://your-site.example/wp-json/kwazi/v1 (shown under Kwazi → Integrations → API & keys).
Kwazi uses WordPress application passwords with HTTP Basic auth: your WordPress username and an application password (not your normal password).
- In WordPress, go to Kwazi → Integrations → API & keys → New application password (or Users → Profile).
- Give it a name you will recognise later, e.g. Zapier. Copy the password: it is shown once.
- Send it with every request:
curl https://your-site.example/wp-json/kwazi/v1/contacts \
-u "your-username:abcd EFGH ijkl MNOP qrst UVWX"
The spaces in the password are optional.
What the key may do
A request with an application password acts as that user, with that user’s Kwazi permissions and "only own records" visibility — exactly as in the app. Every route in the reference names the permission it needs (for example kwazi_view_contacts).
Application passwords skip two-factor login. Therefore only administrators may use them with Kwazi by default; an administrator can allow other roles under API & keys → Who may use application passwords. A user whose role is not allowed gets 403 kwazi_app_password_not_allowed. This setting only applies to Kwazi; WordPress itself and other plugins keep their own rules.
Audit log
Every change made with an application password is recorded in Kwazi → Integrations → Audit log, with the name of the password, and so is the first use of each password per day. Revoke a password you no longer use.
HTTPS
WordPress only offers application passwords on sites with HTTPS (local development sites excepted). Never send a password over plain HTTP.
