tporret API Data Importer is an API-first ETL pipeline for WordPress: authenticated REST ingestion, staged queue processing, Twig-based transforms, featured image sideloading, and an operations dashboard built for real production workloads.
Every import follows a clean, staged, idempotent flow that separates extraction, filtering, staging, transformation, loading, and finalization for safer long-running jobs.
API-first auth, staged ETL, Twig mapping, featured image assignment, multisite awareness, and reporting built for teams that need more than a file importer.
Full Twig logic for mapping and title templates, with loops, conditionals, nested object access, and strict validation instead of ad hoc inline PHP.
Tabbed workflow for Source/Auth, Data Rules, Mapping, and Automation with sticky save actions, dry-run preview, and connection testing.
Nine live metrics across environment health, security, and performance with charts, status indicators, and audit activity feed.
Dedicated UI for none, bearer, api_key_custom, and basic_auth. Authenticated REST endpoints are first-class, not bolt-on edge cases.
Resolve nested array paths, filter before load, stage into queue-backed temp tables, and keep extraction isolated from transformation and load.
Off, hourly, twice daily, daily, or custom minute-based schedules per job with manual runs and trigger context tracking.
Test endpoints, preview sample payloads, and dry-run Twig output directly from the workspace before any production write happens.
Target post type, default post settings, custom meta mappings, and optional read-only locking are scoped per import job.
Map an image URL path, sideload to the Media Library, deduplicate by source URL, and optionally assign the imported asset as the post thumbnail.
An honest strategic view: this plugin is strongest when the job is authenticated API ingestion, secure transformation, and long-running ETL rather than simple file imports.
For API-driven imports, WPAI often depends on extra PHP customization around request handling. Here, bearer tokens, custom API-key headers, basic auth, and unauthenticated endpoints are already part of the import UI.
Instead of encouraging arbitrary inline PHP, this plugin uses a constrained Twig environment, template validation limits, SHA256-based template audit logging, SSRF allowlists, and encrypted credential storage with masked REST responses.
Extraction, filtering, staging, transformation, and load are separated on purpose. That queue-backed pipeline reduces the blast radius of slow endpoints and makes recurring imports safer under real-world load.
Users can write inline Twig conditionals and loops, set title templates, configure featured image source paths, and choose target post behavior from one workspace instead of bouncing between UI fields and helper PHP snippets.
The tabbed workspace keeps complex jobs understandable: connect first, shape the data, define templates, then control automation and load behavior.
Public endpoints
Authorization header
Any key name
Username + password
A Tableau-style React command center with live KPIs, sparklines, charts, and audit activity for environment health, security posture, and API performance.
When drag-and-drop mapping hits its ceiling, Twig takes over with real template logic and safer constraints.
SSRF controls, template constraints, audit trails, credential protection, and per-import access rules are built into the product instead of being left to custom snippets.
Hostname and CIDR allowlists with DNS resolution. Private and loopback targets are blocked by default, with HTTPS enforced unless you deliberately loosen it.
Blocked tags, syntax checks, size limits, expression limits, and nesting depth limits keep transforms powerful without turning imports into arbitrary code execution.
Template edits are logged with before/after SHA256 hashes, actor identity, and timestamps so teams can review exactly what changed and when.
Auth tokens and passwords are encrypted at rest, masked in REST responses, and preserved safely on update without re-exposing secrets to operators.
Rendered content and custom meta pass through sanitization before persistence, helping keep transformed output safe as it moves into WordPress storage.
Imported posts can be locked against edit, delete, and quick-edit based on import configuration instead of relying on one global post type rule.
API-first, open source, and built for repeatable ETL in WordPress without license locks or template-PHP workarounds.