Trying to avoid including wp-load.php

Question

I am working a plugin where I am trying to connect an HR system with WordPress. There is an XML API on the HR system so I have written the plugin to take the data and put it into a WordPress database table specific to my plugin. This is all done via the built in AJAX etc but there was a request for the person to be able to schedule a task so that it wasn't querying the HR system on every site visit (the list of positions need to be displayed on the site front page). Then the problem becomes syncing. This is an IIS environment so they want to use Scheduled Tasks to sync the site. I explained the WordPress scheduled task API but they prefer to have it sync manually through their own infrastructure.

How do I create code (essentially a php file) that can be run by a scheduler without username/password without calling wp-load.php? Their scheduler needs to be able to run a URL alone so this makes it somewhat difficult.

I'm trying to explain this without code since its a generic problem but in this case, the bulk script I have created and works looks like this:

if ( !defined('WP_LOAD_PATH') ) {

    /** classic root path if wp-content and plugins is below wp-config.php */
    $classic_root = dirname(dirname(dirname(dirname(dirname(__FILE__))))) . '/' ;
    //echo $classic_root;
    if (file_exists( $classic_root . 'wp-load.php') )
        define( 'WP_LOAD_PATH', $classic_root);
    else
        if (file_exists( $path . 'wp-load.php') )
            define( 'WP_LOAD_PATH', $path);
        else
            exit("Could not find wp-load.php");
}

// let's load WordPress
require_once( WP_LOAD_PATH . 'wp-load.php');

// If the plugin class is not found, die.
if (!class_exists('Aragon_eRH_RSS')) {
    die('Aragon-eRH RSS not installed.');
}

$core = new Aragon_eRH();
$core->aerh_xml_parser_bulk();

Now they can run http://site.com/wp-content/plugins/aragon-erh-rss/lib/bulk-sync.php?nonce=thenonce

This performs the syncing function. Note that there is a nonce required and can be changed from the plugin's admin menu. See screenshot below:

Note: I want to avoid it because:

1. Considered bad practice
2. Plugin was rejected due to including WP-Load

Answer 1

Add a rewrite endpoint to give your plugin a public URL-

function wpa_my_endpoint(){
    add_rewrite_endpoint( 'my_api', EP_ROOT );
}
add_action( 'init', 'wpa_my_endpoint' );

After you flush rewrite rules, you'll have the URL available for the scheduler to ping.

http://example.com/my_api/do/something/

Then catch those requests on the parse_query action to invoke your plugin action:

function wpa_parse_query( $query ){
    if( isset( $query->query_vars['my_api'] ) ){
        include( plugin_dir_path( __FILE__ ) . 'stuff/things.php');
        exit;
    }
}
add_action( 'parse_query', 'wpa_parse_query' );