skilld
All skills
wordpress avatar

/wp-rest-api

@20324d2 official
by wordpresswordpress/agent-skills2.2k stars
327

Use when building, extending, or debugging WordPress REST API endpoints/routes: register_rest_route, WP_REST_Controller/controller classes, schema/argument validation, permission_callback/authentication, response shaping, register_rest_field/register_meta, or exposing CPTs/taxonomies via show_in_rest.

Ask your Agent

Use this Skill: https://skilld.dev/gh/wordpress/agent-skills/wp-rest-api

This session only. Nothing lands on disk.

referencescustom-content-types.md

≈190 tokens on demand. Your agent reads this file only when SKILL.md points to it.

Custom Content Types (summary)

Custom post types

  • Set show_in_rest => true in register_post_type() to expose in wp/v2.
  • Use rest_base to change the route slug.
  • Optionally set rest_controller_class (must extend WP_REST_Controller).

Custom taxonomies

  • Set show_in_rest => true in register_taxonomy().
  • Use rest_base and optional rest_controller_class (default WP_REST_Terms_Controller).

Adding REST support to existing types

  • Use register_post_type_args or register_taxonomy_args filters to enable show_in_rest for types you do not control.

Discovery links for custom controllers

  • If you use a custom controller class, use rest_route_for_post or rest_route_for_term filters to map objects to routes.

Source: SKILL.md on GitHub

Third-party checks

1 warning16d5 checks · Risk SAFE
  • Gen Agent Trust Hub16d

    The skill is safe and provides comprehensive guidance on building secure WordPress REST APIs, following best practices like mandatory permission callbacks and input validation. A low-severity risk of indirect prompt injection is present because the skill processes external source code as its primary function.

  • Socket16d

    No alerts

  • Snyk16d

    Risk: LOW · No issues

  • Runlayer7mo

    7/7 files flagged

  • ZeroLeaks5mo

    Score: 93/100 · 2 sections analyzed

Provenance

Signed by skilld at 20324d2. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub 2 days ago.

Activeupdated 3 months ago

Capability

Other metadata
compatibility
Targets WordPress 7.0+ (PHP 7.4.0+). Filesystem-based agent with bash + node. Some workflows require WP-CLI.

Topics

  • wordpress
  • rest-api
  • php
  • endpoints
  • authentication
  • schema-validation
  • custom-post-types
  • taxonomies
  • permissions

README badge

README badge for wordpress/agent-skills/wp-rest-api

What it does

Registers and debugs WordPress REST API endpoints, custom routes, and field exposure using register_rest_route, WP_REST_Controller classes, schema validation, and permission callbacks. Use this when building custom endpoints, exposing custom post types or taxonomies via REST, or troubleshooting authentication and response formatting issues in WordPress 6.9+.

Generated from the current SKILL.md.

Frequently asked

Does this skill work with WordPress versions below 6.9?
The skill targets WordPress 6.9+ (PHP 7.2.24+). If your site runs an older version, you should call that out before proceeding, as some workflows may not apply.
What authentication methods does this skill support?
The skill covers cookie auth with nonce for wp-admin/JS clients, application passwords (basic auth) for external clients, and integration with auth plugins. Choose based on your client type.
Can I expose custom post types and taxonomies via REST?
Yes. Use `show_in_rest => true` plus optional `rest_base` and `rest_controller_class` arguments on post type/taxonomy registration to expose them under the `wp/v2` namespace.
How do I add custom fields or metadata to REST responses?
Use `register_rest_field` for computed fields or `register_meta` with `show_in_rest` for stored metadata. For object/array meta, define the schema in `show_in_rest.schema`.
What should I do if I get a 404 error on my endpoint?
Check that `rest_api_init` is firing, verify the route path is correct, and ensure permalinks are enabled (or use `?rest_route=` as a fallback). Also confirm the namespace is registered via `/wp-json/`.

Generated from the current SKILL.md. These answers refresh after source changes.