DMSI Advanced API creates exactly 12 database tables on activation. All table names are prefixed with the WordPress table prefix ({wpdb->prefix}).
| Table | Purpose | Retention |
|---|---|---|
dmsi_aapi_keys | API key management — stores key hash, display prefix (dmsi_key_*), scopes, IP whitelist, expiry, and status | Permanent |
dmsi_aapi_oauth_clients | OAuth 2.0 client registrations — stores client_id, client_secret_hash, redirect_uris, and allowed scopes | Permanent |
dmsi_aapi_oauth_codes | OAuth 2.0 authorization codes — stores temporary codes with 10-minute TTL, including code_challenge for PKCE | 10 minutes (TTL-based) |
dmsi_aapi_oauth_tokens | OAuth 2.0 access and refresh tokens — tracks token hash, expiry, and revocation status | Permanent |
dmsi_aapi_jwt_blacklist | Revoked JWT token identifiers (jti) — used to reject tokens that have been explicitly revoked before expiry | Until token expiry |
dmsi_aapi_logs | API request logs — records endpoint, HTTP method, status code, response time (ms), IP address, and request ID | 30 days |
dmsi_aapi_rate_limit_config | Rate limit tier configuration — stores tier name, requests per hour, burst_limit, and per-endpoint overrides | Permanent |
dmsi_aapi_rate_limit_counters | Fixed-window rate limit counters — stores per-identifier, per-endpoint request counts with window start and reset timestamps | 5 minutes (cron cleanup) |
dmsi_aapi_alert_rules | Alert rule definitions — stores alert type, conditions, notification channels, and evaluation frequency | Permanent |
dmsi_aapi_alert_history | Triggered alert records — stores rule ID, alert type, message, and context payload | 30 days |
dmsi_aapi_webhook_endpoints | Webhook endpoint registrations — stores URL, subscribed events, secret hash, and active status | Permanent |
dmsi_aapi_webhook_logs | Webhook delivery logs — stores endpoint ID, event name, HTTP status code, attempt count, and next retry timestamp | 7 days |
Sandbox Tables #
When sandbox mode is enabled, four additional tables are created to hold isolated sandbox data:
dmsi_aapi_sandbox_customersdmsi_aapi_sandbox_productsdmsi_aapi_sandbox_licensesdmsi_aapi_sandbox_activations
These tables mirror the structure of their DDLS equivalents. Requests authenticated with the sandbox key read from and write to these tables only. No sandbox data affects production records.
Notable Column Details #
dmsi_aapi_rate_limit_config.burst_limit— the column name isburst_limit(notburst_per_minute). It holds the maximum number of requests allowed in a short burst window before the sustained hourly rate applies.dmsi_aapi_oauth_codesstorescode_challengeandcode_challenge_methodcolumns to support PKCE (Proof Key for Code Exchange) for public OAuth clients.