As of PMPro 3.9, Paid Memberships Pro registers a set of abilities with the WordPress Abilities API. An ability is a described action with defined inputs, outputs, and a permission check. Other code can discover and run abilities in PHP, over the WordPress REST API, and from MCP clients through an MCP adapter plugin that supports the Abilities API.

Requirements

• WordPress 6.9 or higher. The Abilities API is part of WordPress core as of 6.9. On earlier versions PMPro skips registration and nothing changes.
• Paid Memberships Pro 3.9 or higher.
• A logged-in user with the capability the ability requires. Every ability checks permissions when it runs, so a request from a user without the right capability is denied.

PMPro registers a pmpro ability category, labeled “Paid Memberships Pro”, and the abilities below inside it. To turn the abilities off on a site, return false from the pmpro_enable_abilities_api filter.

Available Abilities

Ability	What it does	Required capability
pmpro/levels-query	Lists membership levels, with optional text search.	pmpro_membershiplevels
pmpro/member-memberships-get	Returns the memberships held by one user.	Edit members*
pmpro/member-membership-change	Gives a user a membership level, without running checkout or collecting payment.	Edit members*
pmpro/member-membership-cancel	Cancels one membership level for a user.	Edit members*
pmpro/orders-query	Lists orders with filters.	pmpro_orders
pmpro/order-get	Returns one order by ID or code.	pmpro_orders
pmpro/subscriptions-query	Lists subscriptions with filters.	Edit members*
pmpro/subscription-get	Returns one subscription by ID.	Edit members*
pmpro/search-query	Searches users, subscriptions, orders, reports, levels, and discount codes, using the same buckets as the PMPro quick search.	Depends on the scope (see below)

Users with the manage_options capability, such as administrators, can run all of the abilities. *”Edit members” is the pmpro_edit_members capability by default. If a site changes it with the pmpro_edit_member_capability filter, the abilities follow that change.

The search ability checks permission by scope: users and subscriptions need the edit members capability, orders needs pmpro_orders, reports needs pmpro_reports, levels needs pmpro_membershiplevels, and discount_codes needs pmpro_discountcodes. With the all scope, the user needs at least one of those capabilities.

Inputs and Outputs

pmpro/levels-query

Input	Type	Description
include_hidden	boolean	Include levels that are hidden from the levels page. Default: false.
query	string	Only return levels whose name or description contains this text.
limit	integer	Levels per page, 1 to 50. Default: 20.
page	integer	Page number. Default: 1.

Returns items (an array of levels), total, page, and limit. Each level has id, name, description, allow_signups, initial_payment, billing_amount, cycle_number, cycle_period, billing_limit, trial_amount, trial_limit, expiration_number, expiration_period.

pmpro/member-memberships-get

Input	Type	Description
user_id	integer	Required. The user to look up.
include_inactive	boolean	Also return the user’s past memberships. Default: false.

Returns user_id, memberships, and membership_count. Each membership has the level fields above plus status, startdate, and enddate. Dates are ISO 8601 strings or null.

pmpro/member-membership-change

Input	Type	Description
user_id	integer	Required. The user to change.
level_id	integer	Required. The level to give the user.
old_level_status	string	Status for the membership the user is leaving. One of inactive, changed, admin_changed, cancelled, admin_cancelled, expired. Default: admin_changed.

Returns success, status (changed or unchanged if the user already had the level), user_id, level_id, previous_memberships, current_memberships, and a message. The ability returns an error if the user or level does not exist.

pmpro/member-membership-cancel

Input	Type	Description
user_id	integer	Required. The user whose membership to cancel.
level_id	integer	Required. The level to cancel.

Returns the same fields as the change ability, with status set to cancelled. The membership is cancelled with the admin_cancelled status.

pmpro/orders-query and pmpro/subscriptions-query

Input	Type	Description
user_id	integer	Only return records for this user.
membership_level_id	integer	Only return records for this level.
status	string	Only return records with this status.
gateway	string	Only return records for this gateway.
limit	integer	Records per page, 1 to 50. Default: 20.
page	integer	Page number. Default: 1.

Both return items, total, page, and limit. Order items have id, code, user_id, membership_level_id, status, total, subtotal, tax, gateway, gateway_environment, timestamp. Subscription items have id, user_id, membership_level_id, status, gateway, startdate, enddate, next_payment_date, billing_amount, cycle_number, cycle_period, billing_limit, trial_amount, trial_limit. Subscription output leaves out gateway transaction IDs, and order output leaves out billing and card details.

pmpro/order-get and pmpro/subscription-get

Pass order_id or order_code to pmpro/order-get, or subscription_id (required) to pmpro/subscription-get. Each returns a single record in the same shape as the query items. If nothing matches, the ability returns a not found error.

pmpro/search-query

Input	Type	Description
query	string	Required. The search text.
scope	string	Required. One of all, users, subscriptions, orders, reports, levels, discount_codes.
limit	integer	Results per group, 1 to 20. Default: 10.

Returns query, scope, and results, a list of groups. Each group has a scope, a label, and items, where each item has an id, title, url, and entity_type.

Using Abilities Over the REST API

Each PMPro ability is registered with REST visibility turned on, so it is available through the WordPress Abilities REST API. That API is part of WordPress, not PMPro, so see the WordPress Abilities API documentation for the full details. The routes below are in the wp-abilities/v1 namespace.

• GET /wp-json/wp-abilities/v1/abilities lists the abilities.
• GET /wp-json/wp-abilities/v1/abilities/pmpro/levels-query shows the definition of one ability.
• /wp-json/wp-abilities/v1/abilities/pmpro/levels-query/run runs it.

WordPress chooses the HTTP method from each ability’s annotations, and any other method returns a 405 error:

• Query and get abilities (pmpro/levels-query, pmpro/member-memberships-get, pmpro/orders-query, pmpro/order-get, pmpro/subscriptions-query, pmpro/subscription-get, pmpro/search-query) are read-only, so use GET.
• Change and cancel (pmpro/member-membership-change, pmpro/member-membership-cancel) are marked destructive, so use DELETE. This applies to the change ability too, even though it gives a member a level.

For both methods, send the input as query parameters in the form input[field]=value. Numbers can be sent as plain text. A JSON string in a single input parameter is not accepted.

# List the first five membership levels
curl -u 'USERNAME:APPLICATION_PASSWORD' \
  'https://example.com/wp-json/wp-abilities/v1/abilities/pmpro/levels-query/run?input%5Blimit%5D=5'

# Cancel level 2 for user 123
curl -X DELETE -u 'USERNAME:APPLICATION_PASSWORD' \
  'https://example.com/wp-json/wp-abilities/v1/abilities/pmpro/member-membership-cancel/run?input%5Buser_id%5D=123&input%5Blevel_id%5D=2'

Requests must be authenticated. For access from another system, an application password is the usual choice. The user still needs the capability for the ability, so create a dedicated user with only the access the integration needs.

Using Abilities With MCP Clients

Model Context Protocol (MCP) clients, such as AI assistants, can use abilities through an MCP adapter plugin that supports the WordPress Abilities API. PMPro marks every ability as public and as an MCP tool, so an adapter that exposes public abilities will list them. The adapter handles the connection and authentication, so follow its own setup instructions.

Running Abilities in PHP

Inside WordPress, get an ability with wp_get_ability() and call execute() with the input. The permission callback still runs, so the current user must have the required capability.

$ability = wp_get_ability( 'pmpro/orders-query' );
$result  = $ability->execute( array(
	'status' => 'success',
	'limit'  => 10,
) );