wp-rest-api

Design and audit secure WordPress REST endpoints with validation, sanitization, and authorization.

21|1|Updated Apr 29, 2026

Search Tags:#security #validation #endpoints #wordpress #rest-api #nonce

Ready to run

npx skills add https://github.com/Lonsdale201/wp-agent-skills --skill wp-rest-api-lonsdale201

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: wp-rest-api
Source: https://github.com/Lonsdale201/wp-agent-skills/tree/main/wordpress/wp-rest-api
Command: npx skills add https://github.com/Lonsdale201/wp-agent-skills --skill wp-rest-api-lonsdale201

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

WordPress REST endpoints can be insecure or hard to audit; this skill guides developers to scaffold and review endpoints with proper authorization, input validation, and safe responses.

Core Features & Use Cases

Scaffolds endpoints registered via register_rest_route and rest_api_init.
Enforces a non __return_true permission_callback for state-changing routes, robust args schemas, and object-level capability checks.
Useful for creating new endpoints, auditing existing ones in PRs, migrating from admin-ajax, or building headless integrations.

Quick Start

Scaffold a new REST endpoint with register_rest_route, define a proper permission_callback, an args schema, and return WP_REST_Response or WP_Error.

Frequently Asked Questions about wp-rest-api

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I create a secure WordPress REST API endpoint?▼

To create a secure WordPress REST API endpoint, register it via register_rest_route during rest_api_init, define a proper permission_callback for authorization, enforce an args schema for validation, and return WP_REST_Response or WP_Error for safe response handling.

Why does my WordPress permission_callback use __return_true?▼

Using __return_true as a permission_callback makes WordPress REST endpoints insecure by bypassing authorization. You should implement object-level capability checks to verify user permissions before allowing state-changing operations.

What is the best way to migrate from admin-ajax to the WordPress REST API?▼

The best way to migrate from admin-ajax is to scaffold new routes using register_rest_route with a robust args schema, proper permission_callback, and WP_REST_Response returns to ensure secure and structured data handling.

How do I validate and sanitize input in a custom WordPress REST endpoint?▼

To validate and sanitize input in a custom WordPress REST endpoint, define a robust args schema within register_rest_route, ensuring proper sanitization callbacks and authorization checks are applied before processing the request.

Can I use WordPress REST endpoints for headless integrations?▼

Yes, you can use WordPress REST endpoints for headless integrations by designing secure routes with register_rest_route, enforcing capability checks, and returning structured WP_REST_Response objects for reliable frontend data consumption.

When do I need to use WP_Error in WordPress REST API responses?▼

You need to use WP_Error in WordPress REST API responses when handling invalid input, failed authorization, or processing errors, ensuring safe response handling by returning structured error data instead of generic messages.