skilld
All skills
wordpress avatar

/wp-rest-api

@20324d2 official
by wordpresswordpress/agent-skills2.2k stars
327

Use when building, extending, or debugging WordPress REST API endpoints/routes: register_rest_route, WP_REST_Controller/controller classes, schema/argument validation, permission_callback/authentication, response shaping, register_rest_field/register_meta, or exposing CPTs/taxonomies via show_in_rest.

Ask your Agent

Use this Skill: https://skilld.dev/gh/wordpress/agent-skills/wp-rest-api

This session only. Nothing lands on disk.

referencesschema.md

≈241 tokens on demand. Your agent reads this file only when SKILL.md points to it.

Schema and Argument Validation (summary)

JSON Schema in WordPress

  • REST API uses JSON Schema (draft 4 subset) for resource and argument definitions.
  • Provide schema via get_item_schema() on controllers or schema callbacks on routes.
  • Schema enables discovery (OPTIONS) and validation.

Validation + sanitization

  • Use rest_validate_value_from_schema( $value, $schema ) then rest_sanitize_value_from_schema( $value, $schema ).
  • If you override sanitize_callback, built-in schema validation will not run; use rest_validate_request_arg to keep it.
  • WP_REST_Controller::get_endpoint_args_for_item_schema() wires validation automatically.

Schema caching

  • Cache the generated schema on the controller instance ($this->schema) to avoid recomputation.

Formats and types

  • Common formats: date-time, uri, email, ip, uuid, hex-color.
  • For array and object types, you must define items or properties schemas.

Source: SKILL.md on GitHub

Third-party checks

1 warning16d5 checks · Risk SAFE
  • Gen Agent Trust Hub16d

    The skill is safe and provides comprehensive guidance on building secure WordPress REST APIs, following best practices like mandatory permission callbacks and input validation. A low-severity risk of indirect prompt injection is present because the skill processes external source code as its primary function.

  • Socket16d

    No alerts

  • Snyk16d

    Risk: LOW · No issues

  • Runlayer7mo

    7/7 files flagged

  • ZeroLeaks5mo

    Score: 93/100 · 2 sections analyzed

Provenance

Signed by skilld at 20324d2. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub 2 days ago.

Activeupdated 3 months ago

Capability

Other metadata
compatibility
Targets WordPress 7.0+ (PHP 7.4.0+). Filesystem-based agent with bash + node. Some workflows require WP-CLI.

Topics

  • wordpress
  • rest-api
  • php
  • endpoints
  • authentication
  • schema-validation
  • custom-post-types
  • taxonomies
  • permissions

README badge

README badge for wordpress/agent-skills/wp-rest-api

What it does

Registers and debugs WordPress REST API endpoints, custom routes, and field exposure using register_rest_route, WP_REST_Controller classes, schema validation, and permission callbacks. Use this when building custom endpoints, exposing custom post types or taxonomies via REST, or troubleshooting authentication and response formatting issues in WordPress 6.9+.

Generated from the current SKILL.md.

Frequently asked

Does this skill work with WordPress versions below 6.9?
The skill targets WordPress 6.9+ (PHP 7.2.24+). If your site runs an older version, you should call that out before proceeding, as some workflows may not apply.
What authentication methods does this skill support?
The skill covers cookie auth with nonce for wp-admin/JS clients, application passwords (basic auth) for external clients, and integration with auth plugins. Choose based on your client type.
Can I expose custom post types and taxonomies via REST?
Yes. Use `show_in_rest => true` plus optional `rest_base` and `rest_controller_class` arguments on post type/taxonomy registration to expose them under the `wp/v2` namespace.
How do I add custom fields or metadata to REST responses?
Use `register_rest_field` for computed fields or `register_meta` with `show_in_rest` for stored metadata. For object/array meta, define the schema in `show_in_rest.schema`.
What should I do if I get a 404 error on my endpoint?
Check that `rest_api_init` is firing, verify the route path is correct, and ensure permalinks are enabled (or use `?rest_route=` as a fallback). Also confirm the namespace is registered via `/wp-json/`.

Generated from the current SKILL.md. These answers refresh after source changes.