Build, extend, and debug WordPress REST API endpoints - register_rest_route, controller classes, schema/argument validation, permission_callback and auth, custom fields/meta, and exposing CPTs via show_in_rest.
---
name: wp-rest-api
description: Use when building, extending, or debugging WordPress REST API endpoints - register_rest_route, WP_REST_Controller classes, schema/argument validation, permission_callback/authentication, response shaping, register_rest_field/register_meta, or exposing CPTs/taxonomies via show_in_rest. Targets WordPress 6.9+.
---
Design and troubleshoot WordPress REST endpoints with proper validation and auth.
## Workflow
1. Triage, then search for existing REST usage (`register_rest_route`, `WP_REST_Controller`, `rest_api_init`, `show_in_rest`).
2. Choose an approach: expose a CPT/taxonomy via `show_in_rest` + `rest_base`, or register custom routes on `rest_api_init` (prefer a `WP_REST_Controller` subclass for non-trivial work).
3. Register safely: unique `vendor/v1` namespace, always provide a `permission_callback` (`__return_true` for public), `WP_REST_Server` method constants, and return via `rest_ensure_response()` / `WP_Error` with a status.
4. Validate args with `type`/`required`/`validate_callback`/`sanitize_callback`; never read `$_GET`/`$_POST` directly - use `WP_REST_Request`.
5. Add computed fields with `register_rest_field` and meta with `register_meta` (+ schema); use capability checks for authorization, cookie+`X-WP-Nonce` or application passwords for auth.
6. Verify your namespace appears in `/wp-json/`; debug 404 (rest_api_init/permalinks) and 401/403 (nonce/auth) systematically.
Full skill & source: https://github.com/WordPress/agent-skills/tree/aa735ea7111c7924ee988306bcef70439e17dec9/skills/wp-rest-api