WordPress REST API Explained: Core Features, Authentication and Uses

The WordPress REST API lets other software read and change your WordPress content over HTTP, using JSON. It is built into WordPress core (since version 4.7), so every modern WordPress site already has one. It is what the block editor uses behind the scenes, and it is how apps, automation tools and other websites can work with your site without anyone logging into the dashboard.

What the REST API is, in plain terms

Think of it as a set of web addresses that return data instead of pages. A request to /wp-json/wp/v2/posts returns your latest posts as JSON. A different request, with the right permission, can create a post, update a page or upload an image. Any system that can send HTTP requests can use it: a mobile app, a CRM, a workflow tool or a script.

Core features

Routes and endpoints

A route is a URL path such as /wp/v2/posts. An endpoint is a route plus an HTTP method. The same route can list posts (GET), create a post (POST), update one (POST or PUT on /wp/v2/posts/123) or delete one (DELETE). Core includes routes for posts, pages, media, categories, tags, comments, users, menus, settings and more.

JSON responses and the schema

Every response is JSON, and every route describes its own fields in a schema. Visiting /wp-json/ on any site shows the available routes. This makes the API predictable: a developer can see which fields exist before writing any code.

Filtering and fields

Requests accept parameters to search, filter by category, sort, paginate and limit fields. For example, ?per_page=10&_fields=id,title,link returns ten posts with only three fields, which keeps responses small and fast.

Authentication and permissions

Public content can be read without logging in. Anything that changes content needs authentication, and the user’s role still applies, so an Editor account cannot change site settings. The common methods:

• Cookie authentication with a nonce, used by the block editor and by code running inside the dashboard.
• Application passwords (built in since WordPress 5.6), the simplest choice for server-to-server integrations. Each one can be revoked on its own.
• OAuth or JWT through plugins, for apps that need token-based login.

Custom endpoints

Developers can add their own routes with register_rest_route(), and custom post types and fields can be exposed with a few lines of code. Plugins such as SEO and form plugins often add their own endpoints this way.

A simple example

A read request for the three newest posts, with only the fields you need:

GET https://example.com/wp-json/wp/v2/posts?per_page=3&_fields=id,title,link

The response is a JSON list. Each item has an id, a title object with the rendered title and a link. To update a post, an authenticated tool sends a POST request to /wp-json/wp/v2/posts/123 (the post ID) with only the fields that change, for example a new title or status. WordPress checks the user’s role, saves the change and returns the updated post, so the tool can confirm the result.

What businesses use it for

• Automation. Publish or update posts from a workflow tool, sync form entries to a CRM, or create pages from a spreadsheet.
• Headless WordPress. Keep WordPress as the editing tool and show the content in a separate front end, such as a React or Next.js site or a mobile app.
• Integrations. Connect booking systems, inventory, reviews or listings with the website.
• Content operations at scale. Bulk-edit categories, fix links or update metadata across hundreds of posts safely.

For step-by-step integration patterns, read how to integrate and extend your website using the WordPress REST API.

Best practices and common problems

• Use a dedicated user with the lowest role that works for each integration, and its own application password. Do not reuse an administrator login.
• Always use HTTPS, and never put passwords or tokens in URLs.
• Request only the fields you need and paginate large lists; asking for 300 full posts at once can time out.
• Check before you write. Read the current content first and confirm it has not changed since you last checked, so an automation never overwrites an editor’s work.
• Expect security tools. Firewalls and security plugins sometimes block API requests or the user list (/wp/v2/users). That is often intended; allow only what your integration needs.
• Log and monitor every automated change so you can trace and undo it.

Securing the API is part of securing the whole site. Our WordPress security guide covers logins, plugins and updates.

Want WordPress to work with the rest of your tools? Cyberset builds integrations and automations around WordPress, from CRM syncs to automated publishing. See automation and CRM services or our WordPress web design services.