WordPress REST API — Read, Create, Update and Custom Endpoints Guide

// WordPress automatically creates REST API routes for:
// - Posts:     /wp/v2/posts
// - Pages:     /wp/v2/pages
// - Categories:/wp/v2/categories
// - Tags:      /wp/v2/tags
// - Users:     /wp/v2/users
// - Media:     /wp/v2/media
// - Comments:  /wp/v2/comments
// - Settings:  /wp/v2/settings
// - Post Types:/wp/v2/types
// - Taxonomies:/wp/v2/taxonomies

# Get the 5 most recent posts
curl https://yoursite.com/wp-json/wp/v2/posts?per_page=5

# Get a single post by ID
curl https://yoursite.com/wp-json/wp/v2/posts/42

# Get posts in a specific category
curl "https://yoursite.com/wp-json/wp/v2/posts?categories=3"

# Get posts with embedded author and featured media data
curl "https://yoursite.com/wp-json/wp/v2/posts?_embed"

# Pretty-print the output
curl https://yoursite.com/wp-json/wp/v2/posts | json_pp

[
  {
    "id": 42,
    "date": "2026-06-27T10:00:00",
    "slug": "hello-world",
    "title": {
      "rendered": "Hello World"
    },
    "content": {
      "rendered": "<p>Welcome to WordPress.</p>",
      "protected": false
    },
    "excerpt": {
      "rendered": "<p>Welcome to WordPress.</p>",
      "protected": false
    },
    "featured_media": 0,
    "categories": [1],
    "tags": [],
    "_links": {
      "self": [{"href": "https://yoursite.com/wp-json/wp/v2/posts/42"}]
    }
  }
]

// Fetch the latest 10 posts
fetch('https://yoursite.com/wp-json/wp/v2/posts?per_page=10')
  .then(response => response.json())
  .then(posts => {
    posts.forEach(post => {
      console.log(post.title.rendered);
      console.log(post.excerpt.rendered);
    });
  })
  .catch(error => console.error('Error:', error));

async function getPosts() {
  try {
    const response = await fetch('https://yoursite.com/wp-json/wp/v2/posts');
    const posts = await response.json();
    return posts;
  } catch (error) {
    console.error('Failed to fetch posts:', error);
  }
}

getPosts().then(posts => {
  // Do something with posts
});

// With _embed, you get author name and featured image URL in one request
fetch('https://yoursite.com/wp-json/wp/v2/posts?_embed')
  .then(res => res.json())
  .then(posts => {
    posts.forEach(post => {
      // Author name is embedded
      const authorName = post._embedded.author[0].name;

      // Featured image URL is embedded
      const featuredImage = post._embedded['wp:featuredmedia']?.[0]?.source_url;

      console.log(post.title.rendered, 'by', authorName);
    });
  });

# Only get id, title, and date for each post
curl "https://yoursite.com/wp-json/wp/v2/posts?_fields=id,title,date"

[
  {
    "id": 42,
    "title": { "rendered": "Hello World" },
    "date": "2026-06-27T10:00:00"
  }
]

curl -X POST https://yoursite.com/wp-json/wp/v2/posts \
  -H "Content-Type: application/json" \
  -H "Authorization: Basic base64(username:password)" \
  -d '{
    "title": "Created via REST API",
    "content": "This post was created using the WordPress REST API.",
    "status": "draft",
    "categories": [1]
  }'

{
  "id": 57,
  "title": { "rendered": "Created via REST API" },
  "status": "draft",
  "content": { "rendered": "<p>This post was created using the WordPress REST API.</p>" }
}

# Publish the draft post we just created (ID 57)
curl -X PATCH https://yoursite.com/wp-json/wp/v2/posts/57 \
  -H "Content-Type: application/json" \
  -H "Authorization: Basic base64(username:password)" \
  -d '{
    "status": "publish"
  }'

# Update a custom field
curl -X PATCH https://yoursite.com/wp-json/wp/v2/posts/57 \
  -H "Content-Type: application/json" \
  -H "Authorization: Basic base64(username:password)" \
  -d '{
    "meta": {
      "my_custom_field": "Updated value"
    }
  }'

// In a WordPress admin page or theme template
const wpApiSettings = {
  root: 'https://yoursite.com/wp-json/wp/v2/',
  nonce: 'your-nonce-here' // Generated by wp_create_nonce('wp_rest')
};

fetch(wpApiSettings.root + 'posts', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'X-WP-Nonce': wpApiSettings.nonce
  },
  body: JSON.stringify({
    title: 'New Post',
    status: 'draft'
  })
});

// In functions.php or a template
wp_localize_script('my-script', 'wpApiSettings', array(
    'root'  => esc_url_raw(rest_url()),
    'nonce' => wp_create_nonce('wp_rest')
));

# Add a new application password, then use it like a regular password
curl -X POST https://yoursite.com/wp-json/wp/v2/posts \
  -H "Content-Type: application/json" \
  -u "username:application_password" \
  -d '{"title": "From an external app", "status": "publish"}'

// Register a custom route
add_action('rest_api_init', function () {
    register_rest_route('myplugin/v1', '/latest-posts/', array(
        'methods'  => 'GET',
        'callback' => 'myplugin_get_latest_posts',
    ));
});

// Callback function
function myplugin_get_latest_posts() {
    $posts = get_posts(array(
        'numberposts' => 5,
        'post_status' => 'publish',
    ));

    if (empty($posts)) {
        return new WP_REST_Response(array(
            'message' => 'No posts found',
            'posts'   => array(),
        ), 200);
    }

    $data = array();

    foreach ($posts as $post) {
        $data[] = array(
            'id'      => $post->ID,
            'title'   => get_the_title($post),
            'link'    => get_permalink($post),
            'date'    => $post->post_date,
            'excerpt' => get_the_excerpt($post),
        );
    }

    return new WP_REST_Response($data, 200);
}

add_action('rest_api_init', function () {
    register_rest_route('myplugin/v1', '/featured-products/(?P<category_id>\d+)', array(
        'methods'  => 'GET',
        'callback' => 'myplugin_get_featured_products',
        'args'     => array(
            'category_id' => array(
                'required'          => true,
                'validate_callback' => function ($param) {
                    return is_numeric($param);
                },
                'sanitize_callback' => 'absint',
            ),
            'per_page' => array(
                'default'           => 10,
                'validate_callback' => function ($param) {
                    return is_numeric($param) && $param > 0 && $param <= 100;
                },
            ),
        ),
    ));
});

function myplugin_get_featured_products($request) {
    $category_id = $request->get_param('category_id');
    $per_page    = $request->get_param('per_page');

    $products = get_posts(array(
        'post_type'      => 'product',
        'posts_per_page' => $per_page,
        'tax_query'      => array(
            array(
                'taxonomy' => 'category',
                'field'    => 'term_id',
                'terms'    => $category_id,
            ),
        ),
    ));

    $data = array();

    foreach ($products as $product) {
        $data[] = array(
            'id'        => $product->ID,
            'name'      => get_the_title($product),
            'price'     => get_post_meta($product->ID, '_price', true),
            'permalink' => get_permalink($product),
        );
    }

    return new WP_REST_Response($data, 200);
}

add_action('rest_api_init', function () {
    register_rest_route('myplugin/v1', '/submit-feedback/', array(
        'methods'             => 'POST',
        'callback'            => 'myplugin_handle_feedback',
        'permission_callback' => function () {
            return is_user_logged_in();
        },
        'args'                => array(
            'rating' => array(
                'required'          => true,
                'validate_callback' => function ($param) {
                    return is_numeric($param) && $param >= 1 && $param <= 5;
                },
            ),
            'message' => array(
                'required'          => true,
                'sanitize_callback' => 'sanitize_text_field',
            ),
        ),
    ));
});

function myplugin_handle_feedback($request) {
    $rating  = $request->get_param('rating');
    $message = $request->get_param('message');
    $user_id = get_current_user_id();

    $feedback_id = wp_insert_post(array(
        'post_type'   => 'feedback',
        'post_title'  => 'Feedback from user ' . $user_id,
        'post_content'=> $message,
        'post_status' => 'publish',
        'meta_input'  => array(
            '_feedback_rating' => $rating,
            '_feedback_user'   => $user_id,
        ),
    ));

    if (is_wp_error($feedback_id)) {
        return new WP_Error('feedback_failed', 'Could not save feedback', array('status' => 500));
    }

    return new WP_REST_Response(array(
        'message' => 'Thank you for your feedback!',
        'id'      => $feedback_id,
    ), 201);
}

register_rest_route(
    'myplugin/v1',                     // Namespace (plugin name + version)
    '/items/(?P<id>\d+)',              // Route with regex parameter
    array(
        // Multiple methods for the same route
        array(
            'methods'             => 'GET',
            'callback'            => 'myplugin_get_item',
            'permission_callback' => '__return_true',     // Public
        ),
        array(
            'methods'             => 'POST',
            'callback'            => 'myplugin_update_item',
            'permission_callback' => function () {
                return current_user_can('edit_posts');
            },
        ),
        array(
            'methods'             => 'DELETE',
            'callback'            => 'myplugin_delete_item',
            'permission_callback' => function () {
                return current_user_can('delete_posts');
            },
        ),
    )
);

// Public — anyone can access
'permission_callback' => '__return_true'

// Logged-in users only
'permission_callback' => function () {
    return is_user_logged_in();
}

// Users who can edit posts
'permission_callback' => function () {
    return current_user_can('edit_posts');
}

// Users who can publish posts
'permission_callback' => function () {
    return current_user_can('publish_posts');
}

// Administrators only
'permission_callback' => function () {
    return current_user_can('manage_options');
}

// Custom capability
'permission_callback' => function () {
    return current_user_can('my_custom_capability');
}

async function fetchAndRenderPosts() {
  try {
    const response = await fetch(
      'https://yoursite.com/wp-json/wp/v2/posts?_embed&per_page=5'
    );
    const posts = await response.json();

    const container = document.getElementById('posts-container');

    posts.forEach(post => {
      const title = post.title.rendered;
      const excerpt = post.excerpt.rendered;
      const link = post.link;
      const authorName = post._embedded.author[0].name;
      const date = new Date(post.date).toLocaleDateString();

      container.innerHTML += `
        <article>
          <h2><a href="${link}">${title}</a></h2>
          <p class="meta">By ${authorName} on ${date}</p>
          <div>${excerpt}</div>
        </article>
      `;
    });
  } catch (error) {
    console.error('Error fetching posts:', error);
  }
}

fetchAndRenderPosts();

document.getElementById('post-form').addEventListener('submit', async (e) => {
  e.preventDefault();

  const formData = new FormData(e.target);

  try {
    const response = await fetch('https://yoursite.com/wp-json/wp/v2/posts', {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'X-WP-Nonce': wpApiSettings.nonce
      },
      body: JSON.stringify({
        title: formData.get('title'),
        content: formData.get('content'),
        status: 'draft',
        categories: [Number(formData.get('category'))]
      })
    });

    const result = await response.json();

    if (response.ok) {
      console.log('Post created with ID:', result.id);
      alert('Post created successfully!');
    } else {
      console.error('Error:', result);
      alert('Failed to create post: ' + result.message);
    }
  } catch (error) {
    console.error('Network error:', error);
  }
});

async function updatePostTitle(postId, newTitle) {
  try {
    const response = await fetch(
      `https://yoursite.com/wp-json/wp/v2/posts/${postId}`,
      {
        method: 'PATCH',
        headers: {
          'Content-Type': 'application/json',
          'X-WP-Nonce': wpApiSettings.nonce
        },
        body: JSON.stringify({
          title: newTitle
        })
      }
    );

    const updatedPost = await response.json();

    if (response.ok) {
      console.log('Post updated:', updatedPost.title.rendered);
    } else {
      console.error('Update failed:', updatedPost);
    }
  } catch (error) {
    console.error('Error updating post:', error);
  }
}

// Usage: updatePostTitle(42, 'Updated Title via API');

import { useState, useEffect } from 'react';

function BlogPosts() {
  const [posts, setPosts] = useState([]);
  const [loading, setLoading] = useState(true);

  useEffect(() => {
    fetch('https://yoursite.com/wp-json/wp/v2/posts?_embed')
      .then(res => res.json())
      .then(data => {
        setPosts(data);
        setLoading(false);
      });
  }, []);

  if (loading) return <div>Loading...</div>;

  return (
    <div className="posts">
      {posts.map(post => (
        <article key={post.id}>
          <h2 dangerouslySetInnerHTML={{ __html: post.title.rendered }} />
          <div dangerouslySetInnerHTML={{ __html: post.excerpt.rendered }} />
        </article>
      ))}
    </div>
  );
}

// pages/posts.js — fetches posts at build time
export async function getStaticProps() {
  const res = await fetch('https://yoursite.com/wp-json/wp/v2/posts?_embed');
  const posts = await res.json();

  return {
    props: { posts },
    revalidate: 3600 // Regenerate page every hour
  };
}

export default function Posts({ posts }) {
  return (
    <div>
      {posts.map(post => (
        <article key={post.id}>
          <h2>{post.title.rendered}</h2>
          <div dangerouslySetInnerHTML={{ __html: post.excerpt.rendered }} />
        </article>
      ))}
    </div>
  );
}

// In a Vue component
export default {
  data() {
    return {
      posts: [],
      loading: true
    };
  },
  mounted() {
    fetch('https://yoursite.com/wp-json/wp/v2/posts?_embed')
      .then(res => res.json())
      .then(data => {
        this.posts = data;
        this.loading = false;
      });
  },
  template: `
    <div v-if="loading">Loading...</div>
    <div v-else>
      <article v-for="post in posts" :key="post.id">
        <h2 v-html="post.title.rendered"></h2>
        <div v-html="post.excerpt.rendered"></div>
      </article>
    </div>
  `
};

// Allow all origins (development only — restrict in production)
add_action('rest_api_init', function () {
    remove_filter('rest_pre_serve_request', 'rest_send_cors_headers');
    add_filter('rest_pre_serve_request', function ($value) {
        header('Access-Control-Allow-Origin: *');
        header('Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE');
        header('Access-Control-Allow-Credentials: true');
        header('Access-Control-Allow-Headers: Authorization, X-WP-Nonce, Content-Type');

        // Handle preflight OPTIONS request
        if ('OPTIONS' === $_SERVER['REQUEST_METHOD']) {
            status_header(200);
            exit;
        }

        return $value;
    });
});

add_filter('rest_pre_serve_request', function ($value) {
    $allowed_origins = array(
        'https://myfrontend.com',
        'https://app.myfrontend.com',
    );

    $origin = isset($_SERVER['HTTP_ORIGIN']) ? $_SERVER['HTTP_ORIGIN'] : '';

    if (in_array($origin, $allowed_origins)) {
        header('Access-Control-Allow-Origin: ' . $origin);
    }

    return $value;
});

add_action('rest_api_init', function () {
    register_rest_route('myplugin/v1', '/popular-posts/', array(
        'methods'  => 'GET',
        'callback' => 'myplugin_get_popular_posts_cached',
    ));
});

function myplugin_get_popular_posts_cached() {
    // Try to get cached data
    $cached = get_transient('popular_posts_cache');

    if (false !== $cached) {
        return new WP_REST_Response($cached, 200);
    }

    // Generate fresh data
    $posts = get_posts(array(
        'meta_key'   => 'post_views_count',
        'orderby'    => 'meta_value_num',
        'order'      => 'DESC',
        'numberposts' => 10,
    ));

    $data = array();

    foreach ($posts as $post) {
        $data[] = array(
            'id'    => $post->ID,
            'title' => get_the_title($post),
            'views' => get_post_meta($post->ID, 'post_views_count', true),
        );
    }

    // Cache for 1 hour
    set_transient('popular_posts_cache', $data, HOUR_IN_SECONDS);

    return new WP_REST_Response($data, 200);
}

// Clear cache when a post is viewed
add_action('wp_head', function () {
    if (is_single()) {
        delete_transient('popular_posts_cache');
    }
});

add_action('rest_api_init', function () {
    register_rest_route('myplugin/v1', '/menu/', array(
        'methods'  => 'GET',
        'callback' => function () {
            $menu = wp_get_nav_menu_items('primary');

            $data = array();

            foreach ($menu as $item) {
                $data[] = array(
                    'title' => $item->title,
                    'url'   => $item->url,
                );
            }

            $response = new WP_REST_Response($data, 200);

            // Cache for 15 minutes in the browser and CDN
            $response->header('Cache-Control', 'public, max-age=900');

            return $response;
        },
    ));
});

# Page 2 of 100 posts per page
curl "https://yoursite.com/wp-json/wp/v2/posts?per_page=100&page=2"

# Only get the fields you need
curl "https://yoursite.com/wp-json/wp/v2/posts?_fields=id,title.rendered,date"

// One request instead of three
fetch('https://yoursite.com/wp-json/wp/v2/posts?_embed')

'args' => array(
    'email' => array(
        'required'          => true,
        'validate_callback' => function ($param) {
            return is_email($param);
        },
        'sanitize_callback' => 'sanitize_email',
    ),
    'count' => array(
        'default'           => 10,
        'sanitize_callback' => 'absint',
    ),
)

// 201 Created
return new WP_REST_Response($data, 201);

// 400 Bad Request
return new WP_Error('invalid_param', 'Invalid email address', array(
    'status' => 400
));

// 404 Not Found
return new WP_Error('not_found', 'Post not found', array(
    'status' => 404
));