WordPress REST API: Complete Developer Guide

The WordPress REST API exposes WordPress data as JSON endpoints accessible via HTTP. This opens WordPress beyond PHP templates — any application, mobile app, or JavaScript frontend can read and write WordPress content. Every WordPress site has the REST API enabled by default at /wp-json/wp/v2/. Common endpoints include /wp-json/wp/v2/posts (blog posts), /wp-json/wp/v2/pages (pages), /wp-json/wp/v2/media (images/files), and /wp-json/wp/v2/users (user data). For converted WordPress sites, the REST API enables powerful integrations: feeding content to mobile apps, connecting with external CRMs, building custom admin interfaces, and creating headless architectures where WordPress serves as a content backend for React/Vue/Next.js frontends. The API follows REST principles: GET for reading, POST for creating, PUT/PATCH for updating, DELETE for removing. Authentication is required for write operations.

**Reading Data (No Auth Required):** Get all posts: GET /wp-json/wp/v2/posts Get single post: GET /wp-json/wp/v2/posts/123 Filter posts by category: GET /wp-json/wp/v2/posts?categories=5 Search posts: GET /wp-json/wp/v2/posts?search=wordpress Pagination: GET /wp-json/wp/v2/posts?page=2&per_page=10 **Writing Data (Auth Required):** Create post: POST /wp-json/wp/v2/posts Body: { title: 'New Post', content: 'Content here', status: 'publish' } Update post: PUT /wp-json/wp/v2/posts/123 Body: { title: 'Updated Title' } Delete post: DELETE /wp-json/wp/v2/posts/123 **Response Format:** All responses return JSON with metadata: • X-WP-Total: Total items • X-WP-TotalPages: Total pages • _links: HAL-style related resource links

Write operations require authentication: **Application Passwords (Recommended)** WordPress 5.6+ includes built-in application passwords: 1. Users → Your Profile → Application Passwords 2. Enter name → Generate 3. Use in Authorization header: Basic base64(username:password) **JWT Authentication (For SPAs)** Install JWT Authentication plugin: 1. POST /wp-json/jwt-auth/v1/token with username/password 2. Receive JWT token 3. Include in subsequent requests: Authorization: Bearer <token> **OAuth 2.0 (For Third-Party Apps)** Full OAuth flow for external application authorization. Use the OAuth Server plugin for WordPress. **Cookie Authentication (For Logged-In Users)** WordPress's default auth for AJAX requests: • Include nonce in request headers • Works for logged-in users on same domain • Not suitable for external applications

Extend the API with custom endpoints in your theme's functions.php or a custom plugin: **Register Custom Route:** add_action('rest_api_init', function() { register_rest_route('myplugin/v1', '/data', array( 'methods' => 'GET', 'callback' => 'my_custom_endpoint', 'permission_callback' => '__return_true' )); }); function my_custom_endpoint($request) { return new WP_REST_Response(array('message' => 'Hello'), 200); } **With Parameters:** register_rest_route('myplugin/v1', '/items/(?P<id>\d+)', array( 'methods' => 'GET', 'callback' => function($request) { $id = $request->get_param('id'); return get_post($id); }, 'permission_callback' => '__return_true' )); **Authenticated Endpoint:** 'permission_callback' => function() { return current_user_can('edit_posts'); } **Custom Post Type Endpoints:** When registering custom post types, add 'show_in_rest' => true to expose them in the API automatically.

Headless WordPress uses WordPress as a content management backend with a separate frontend: **Architecture:** WordPress (Backend) → REST API → React/Next.js/Vue (Frontend) **When to Go Headless:** • Need a highly interactive frontend (complex animations, real-time updates) • Building a mobile app that shares content with website • Multiple frontends consuming same content (website + app + kiosk) • Performance requirements beyond PHP rendering **When to Stay Traditional:** • Content-focused websites (blogs, portfolios, marketing sites) • WooCommerce stores (losing too much plugin functionality) • Team without JavaScript framework experience • SEO is critical (server-rendered WordPress is well-indexed) **Popular Headless Stacks:** • WordPress + Next.js (most popular, excellent SEO with SSR) • WordPress + Gatsby (static site generation, blazing fast) • WordPress + Nuxt.js (Vue equivalent of Next.js) • WordPress + Astro (newer, excellent performance) **AI to Wordpress's Role:** For sites that started headless and need to move to traditional WordPress, AI to Wordpress converts the frontend output into proper WordPress templates — giving you full WordPress functionality without maintaining two separate systems.