WordPress REST API

The WordPress REST API provides programmatic access over HTTP. Base: https://site.com/wp-json/wp/v2/

Core Endpoints

| Resource | Method | Endpoint | |----------|--------|----------| | Posts | GET | /wp/v2/posts | | Single Post | GET | /wp/v2/posts/{id} | | Create Post | POST | /wp/v2/posts | | Pages | GET | /wp/v2/pages | | Users | GET | /wp/v2/users | | Categories | GET | /wp/v2/categories | | Media | GET | /wp/v2/media | | Custom Post Type | GET | /wp/v2/{cpt-slug} |

Authentication

# Application Passwords (WP 5.6+ — preferred for server-to-server)
# Generate at: Users > Profile > Application Passwords
curl -H "Authorization: Basic $(echo -n 'admin:XXXX XXXX XXXX XXXX XXXX XXXX' | base64)" \
  https://site.com/wp-json/wp/v2/posts

# JWT Auth (requires JWT Authentication plugin)
# Get token
curl -X POST https://site.com/wp-json/jwt-auth/v1/token \
  -d "username=admin&password=pass"
# Use token
curl -H "Authorization: Bearer YOUR_JWT_TOKEN" https://site.com/wp-json/wp/v2/posts

Custom REST Endpoint (PHP)

add_action('rest_api_init', function() {
    register_rest_route('myplugin/v1', '/leads', [
        'methods'             => 'POST',
        'callback'            => 'handle_lead_submission',
        'permission_callback' => '__return_true',
    ]);
});

function handle_lead_submission(WP_REST_Request $request) {
    $name  = sanitize_text_field($request->get_param('name'));
    $email = sanitize_email($request->get_param('email'));
    // Save, send notification, etc.
    return new WP_REST_Response(['status' => 'success'], 200);
}

Fetch Posts via JavaScript

const response = await fetch('/wp-json/wp/v2/posts?per_page=10&_embed');
const posts = await response.json();

posts.forEach(post => {
    console.log(post.title.rendered);
    console.log(post._embedded['wp:featuredmedia']?.[0]?.source_url);
});

Restrict REST API to Logged-In Users

// In functions.php — blocks unauthenticated REST requests
add_filter('rest_authentication_errors', function($result) {
    if (!is_user_logged_in()) {
        return new WP_Error(
            'rest_not_logged_in',
            'REST API restricted to authenticated users.',
            ['status' => 401]
        );
    }
    return $result;
});

Common Query Parameters

| Parameter | Description | Example | |-----------|-------------|---------| | per_page | Results per page (max 100) | ?per_page=20 | | page | Pagination | ?page=2 | | search | Full-text search | ?search=keyword | | categories | Filter by category ID | ?categories=5,8 | | _embed | Include embedded data (author, featured image) | ?_embed | | orderby | Sort field | ?orderby=date | | order | Sort direction | ?order=asc |