wp-abilities-api

To expose WordPress abilities via REST, register ability categories using wp_abilities_api_categories_init and abilities using wp_abilities_api_init, then enable meta.show_in_rest. Clients can then query endpoints under wp-abilities/v1 to consume structured permissions.

Registering abilities and categories via REST requires WordPress 6.9 or higher. You must also use the specific Abilities API hooks, wp_abilities_api_categories_init and wp_abilities_api_init, for proper category-first registration placement.

Category-first registration is needed when defining structured permissions for a JS application. Register ability categories early via wp_abilities_api_categories_init, then register the actual abilities inside wp_abilities_api_init to ensure a controlled capability surface.

The best way to provide a controlled capability surface to a JS app is registering abilities in PHP with meta.show_in_rest enabled. This exposes only approved actions via the wp-abilities/v1 REST endpoints for secure client-side consumption.

Verify your exposed WordPress abilities by checking the /wp-json/wp-abilities/v1/abilities and /wp-json/wp-abilities/v1/categories endpoints. Ensure meta.show_in_rest is enabled during the wp_abilities_api_init hook for successful REST exposure.

WordPress abilities may not show in REST if registered outside the wp_abilities_api_init hook, or if meta.show_in_rest is not enabled. Ensure your environment is WordPress 6.9+ and categories are registered first using wp_abilities_api_categories_init.