The WordPress REST API

The WordPress REST API exposes structured resources through HTTP and JSON.

It supports the Block Editor, integrations, mobile clients, headless frontends and external automation.

Routes and Endpoints

A route is a URI pattern such as /wp/v2/posts.

An endpoint defines the methods and callback behavior available for that route.

WordPress uses HTTP methods such as:

• GET for retrieval.
• POST for creation.
• PUT or PATCH for updates.
• DELETE for deletion.

Requests and Responses

WordPress converts an incoming API request into a WP_REST_Request.

Endpoint callbacks return data, WP_REST_Response or WP_Error. WordPress then serializes the result and uses HTTP status codes to communicate success or failure.

Public and Private Data

Content that is public on the website is generally accessible publicly through the API when the object type supports REST.

Private content, protected metadata and privileged actions require authentication and authorization.

Disabling the entire API can break modern WordPress functionality.

Custom Post Types and Taxonomies

Register a custom type with show_in_rest when it should participate in the editor or API.

Review its REST base, controller, supported fields, capabilities and public visibility.

Custom Routes

Register routes on rest_api_init.

A route should define:

• Namespace and version.
• path.
• methods.
• callback.
• permission_callback.
• argument schemas.
• validation and sanitization.
• response status and shape.

Schemas

The REST API uses JSON Schema concepts to describe data.

Schemas support discoverability, validation and consistent client behavior. They are especially important for nested input and reusable clients.

Frequently Asked Questions

Is every WordPress REST endpoint public?

No. Visibility depends on the resource, authentication and permissions.

Should custom routes return raw PHP objects?

Return controlled data structures or REST responses that expose only the intended fields.

Continue Learning

Previous: WordPress APIs: An Overview

Next: REST API Authentication