Evidence record · captured 2026-10-11

WordPress REST API

Guides building and debugging REST endpoints: register_rest_route and WP_REST_Controller classes, schema and argument validation, permission_callback and authentication modes (cookie+nonce, application passwords), response shaping, register_rest_field/register_meta, and exposing CPTs/taxonomies with show_in_rest. Includes a debugging path for 401/403/404 and nonce issues.

Official publisherUnverifiedSource reviewedBehavior not tested

Source review

Editorial assessment

This is a source-only assessment. It does not claim runtime or security testing.

What it does

Focuses the agent on the decision between exposing content through wp/v2 with show_in_rest and writing custom routes. It then enforces route hygiene: a permission_callback on every route, schema-based args, and WP_Error with explicit status codes.

Best for

Debugging a 401, 403 or 404 from a custom endpoint
Exposing a custom post type, taxonomy or registered meta through wp/v2
Adding a namespaced vendor/v1 route with JSON Schema argument validation

Strengths in the source

Requires permission_callback on every route, using __return_true explicitly for public endpoints, and capability checks rather than a logged-in test.
Prefers rest_validate_value_from_schema and rest_sanitize_value_from_schema, and forbids reading $_GET or $_POST inside endpoints.
Its failure list maps symptoms to causes, such as a 404 from disabled permalinks and the ?rest_route= fallback.
Tells the agent to add fields rather than remove core fields from default endpoints.

Limitations

Ships no scripts of its own; the triage step relies on the sibling wp-project-triage script, and route discovery is a manual search.
Covers OAuth and JWT auth plugins only in passing, deferring to each plugin's documentation.
Verification is manual (checking the /wp-json/ index and OPTIONS responses) and assumes a running site to query.

When not to use it

Consuming a WordPress site's API from an external app without changing the site's code.
Block or theme work that touches REST only incidentally.

Reviewed by Retenta editorial on 2026-10-11; scope: source only.

Files included in this review

skills/wp-rest-api/SKILL.md

Evidence and boundaries

Execution · not tested

Retenta has not executed this skill.

Security · not tested

The skill folder bundles no executable scripts. Retenta has not run a security scan.

Pinned publisher source: skills/wp-rest-api/SKILL.md
Revision: 3cf7f6f701300d80166cc0b7e6ebc667501c353d
License evidence: GPL-2.0-or-laterRetenta preserves the license text captured with this immutable upstream snapshot; no independent legal or security review is claimed.
Last source change: 2026-07-08
Independent verification: Published by WordPress (WordPress.org contributors), but not independently verified by a third-party reviewer.
Upstream repository: Open publisher repository