WordPress REST API

REST API batch requests: several changes in one HTTP call WordPress 5.6 added a batch endpoint to the REST API, /wp-json/batch/v1. It accepts a list of requests in one HTTP call and runs them one after the other on the server. That saves round trips when a screen saves many things at once, for example…

Learn how JavaScript Promises and async/await work with fetch API examples and parallel requests using Promise.all.

show_in_rest and register_post_meta(): custom post types and meta in the REST API and the block editor A custom post type registered without show_in_rest has no REST endpoint and opens in the classic editor: the block editor loads and saves posts through the REST API. The same goes for meta: a field is part of the…

WooCommerce REST API: read orders and update stock from another system WooCommerce has its own REST API under /wp-json/wc/v3/: products, orders, customers, coupons, shipping zones and more. An ERP, a warehouse system or a script on another server can read new orders and update stock through it, without any plugin on the shop. Unlike most…

Efficient REST API requests: _fields, _embed and pagination headers A post in the default REST API response has about thirty fields: rendered and raw content, GUID, links, meta, template and more. A front end that shows a list of titles with images and authors needs a small part of it, but without care it downloads…

admin-ajax.php or the REST API: which one for AJAX in WordPress WordPress has two ways to answer requests from JavaScript. admin-ajax.php exists since WordPress 2.1: every request goes to one file with an action parameter. The REST API (in core since 4.7) has its own URL per resource, HTTP methods, argument validation and JSON responses.…

current_user_can(): capability checks in admin pages, AJAX and REST Every decision “may this user do this?” in WordPress belongs to the capability system. current_user_can() checks the logged-in user against a capability, and a missing check is the most common cause of privilege escalation bugs in plugins: a settings page, an AJAX handler or a REST…

WP_Error: return errors the WordPress way A function that returns false on failure tells the caller that something went wrong, but not what. WordPress has its own error object for this, WP_Error: it carries an error code, a message and optional data, and it can hold several errors at once. Core functions such as wp_insert_post(),…

Extend the WordPress REST API with register_rest_field() The REST API returns a fixed set of fields for every post: id, title, content, status and so on. Data that a theme or plugin keeps in post meta, in terms or in its own tables is not there. With register_rest_field() you add it to the existing response,…