WordPress And Custom REST API Endpoints

WordPress's REST API provides programmatic access to site content. Custom endpoints extend the API for specific use cases: mobile app integration, external service integration, specific data exposure.

The patterns for adding custom endpoints safely are well-defined. Done well, they enable integration; done poorly, they expose security holes.

The basic endpoint registration

Register an endpoint via the rest_api_init action:

add_action('rest_api_init', function() {
    register_rest_route('myplugin/v1', '/data', array(
        'methods' => 'GET',
        'callback' => 'myplugin_get_data',
        'permission_callback' => 'myplugin_permissions'
    ));
});

The endpoint becomes available at /wp-json/myplugin/v1/data.

The permission callback

The permission_callback function determines who can access the endpoint. Returning true means anyone; specific checks limit access.

function myplugin_permissions() {
    return current_user_can('read');
}

Always include a permission callback. Endpoints without permission checks are accessible to anyone, including attackers.

The input validation

Endpoint parameters should be validated. The args parameter to register_rest_route specifies expected parameters with validation rules.

Validation prevents bad data from reaching the callback. The callback can assume valid input.

The output structure

Return structured data with consistent format. Wrap responses in a consistent structure that includes status, data, and any error messages.

The consistency helps clients consume the API. Random response structures produce client-side complications.

The rate limiting

For public endpoints, rate limiting prevents abuse. WordPress doesn't include rate limiting natively; plugins or custom code can add it.

Without rate limiting, attackers can hammer endpoints with requests. Server resources get consumed; legitimate users suffer.

The authentication

WordPress REST API supports various authentication methods: cookies (for browser-based access from logged-in users), application passwords (for external integrations), OAuth (for third-party apps).

The authentication choice depends on the use case. Application passwords work for most external integration needs.

The honest framing

Custom REST endpoints are powerful for integration but need careful implementation. The patterns are well-documented in WordPress's developer documentation.

For sites adding custom endpoints, the security patterns (permission callbacks, input validation, rate limiting) are non-negotiable. Without them, the endpoints become attack vectors.