AJAX Endpoints

AJAX Endpoints

The plugin registers two AJAX actions. Both require the user to be logged in and require nonce verification. Neither has a nopriv counterpart — they are inaccessible to logged-out users.

---

Delete Scheduled Activity

Action: delete_schedule_activity

Handler: wp_ajax_delete_schedule_activity

Nonce action: bp_activity_delete_link

The nonce for this action is embedded in the BuddyPress delete link for each activity. In the page HTML it appears as the _wpnonce query parameter in the href of the delete button. The plugin reads it with getDeleteActivityLinkParams( href, '_wpnonce' ) in JavaScript.

Request:

jQuery.ajax({
    url: bpsa_ajax_object.ajax_url,
    type: 'post',
    data: {
        action:     'delete_schedule_activity',
        id:         activityId,      // integer — the activity ID
        _wpnonce:   nonceFromHref,   // from the delete link href, NOT from bpsa_ajax_object.ajax_nonce
        is_single:  false            // true when on a single-activity page
    },
    dataType: 'json'
});

Response on success:

{
    "success": true,
    "data": {
        "deleted": [123]
    }
}

When is_single is true, a redirect key is also present:

{
    "success": true,
    "data": {
        "deleted": [123],
        "redirect": "https://example.com/members/username/"
    }
}

Response on error:

{
    "success": false,
    "data": {
        "feedback": "<div class=\"bp-feedback bp-messages error\">There was a problem deleting your scheduled activity. Please try again.</div>"
    }
}

Security checks (server-side):

1. Must be a POST request
2. _wpnonce verified against action bp_activity_delete_link
3. User must be logged in
4. id must be numeric and non-empty
5. Activity must exist
6. bp_activity_user_can_delete( $activity ) must return true

---

Load More Scheduled Activities

Action: get_schedule_activity

Handler: buddypress_get_load_more_schedule_activity

Nonce action: bpsa_ajax_security

The nonce for this action is available at bpsa_ajax_object.ajax_nonce.

Request:

jQuery.ajax({
    url:      bpsa_ajax_object.ajax_url,
    type:     'post',
    data: {
        action:       'get_schedule_activity',
        page:         2,                              // integer, 1-1000
        offset_lower: offsetLower,                   // from bp.Nouveau.getLinkParams()
        method:       'append',
        scope:        'schedule-activity',
        object:       'activity',
        _wpnonce:     bpsa_ajax_object.ajax_nonce    // from bpsa_ajax_object
    },
    dataType: 'json'
});

Response on success:

{
    "success": true,
    "data": {
        "contents": "<div class=\"buddypress-schedule-activity-lists ...\">...</div>"
    }
}

The contents value is a full HTML fragment containing the activity list. The frontend appends it to .buddypress-schedule-activity-lists .schedule-activity ul.activity-list.

Response on error (security failure or not logged in):

{
    "success": false,
    "data": {
        "message": "Security check failed."
    }
}

Security checks (server-side):

1. _wpnonce verified against action bpsa_ajax_security
2. User must be logged in
3. page is clamped to 1-1000

---

Nonce Summary

Endpoint	Nonce action	Where to get the nonce
delete_schedule_activity	bp_activity_delete_link	From the _wpnonce param in the activity’s delete link href
get_schedule_activity	bpsa_ajax_security	bpsa_ajax_object.ajax_nonce

A common mistake is using bpsa_ajax_object.ajax_nonce for delete requests. That nonce verifies bpsa_ajax_security and will fail the bp_activity_delete_link check, returning a 400-level error response.

---

Custom Integration Example

If you need to trigger a delete from your own JavaScript:

// Assuming you already have the activity's delete link href.
function getParam( url, param ) {
    var qs = ( url.indexOf('?') !== -1 ) ? '?' + url.split('?')[1] : '';
    if ( ! qs ) return null;
    var params = {};
    qs.replace( /^\?/, '' ).split('&').forEach( function(kv) {
        var parts = kv.split('=');
        params[ parts[0] ] = decodeURIComponent( parts[1] || '' );
    });
    return param ? params[param] : params;
}

jQuery.ajax({
    url:  bpsa_ajax_object.ajax_url,
    type: 'post',
    data: {
        action:    'delete_schedule_activity',
        id:        activityId,
        _wpnonce:  getParam( deleteHref, '_wpnonce' ), // extract from the link
        is_single: 0
    },
    dataType: 'json',
    success: function( response ) {
        if ( response.success ) {
            // Activity deleted.
        }
    }
});