How to Create a Custom WordPress REST API Endpoint in 2026
17 August 2026
Learn to create a custom WordPress REST API endpoint in 2026. Step-by-step UK guide with code examples, security tips, and best practices.
Understanding the WordPress REST API and Custom Endpoints
The WordPress REST API lets you interact with your site remotely by sending HTTP requests. By default, WordPress provides endpoints for posts, pages, comments, users, and more. However, you often need to expose custom data or actions that aren't covered by the defaults. That's where custom endpoints come in. For example, a UK-based e-commerce plugin might need an endpoint to fetch delivery zones by postcode, or a membership site might require a custom user status endpoint. Creating a custom endpoint allows you to extend the API cleanly and securely, giving you full control over the data format and permissions. In this guide, we'll walk through the process from start to finish, using code that you can adapt to your own projects.
Registering a Custom Route with register_rest_route()
The foundation of any custom endpoint is the register_rest_route() function. You'll typically place this inside a custom plugin or your theme's functions.php file. The function accepts three arguments: the namespace, the route, and an array of options. The namespace prevents conflicts between different plugins – a good practice is to use something like 'myplugin/v1'. For example, to create an endpoint at /wp-json/myplugin/v1/status, you'd write: add_action('rest_api_init', function() { register_rest_route('myplugin/v1', '/status/', array('methods' => 'GET', 'callback' => 'myplugin_get_status')); }); This registers a GET endpoint. You can also support multiple methods like POST and PUT. Remember to flush permalinks after registering new routes – just visit Settings > Permalinks and click Save.
Handling Requests: Callbacks, Permissions, and Parameters
Each route needs a callback function that returns the data or performs an action. The callback receives a WP_REST_Request object, which you can use to access URL parameters, headers, and the request body. For example, if you have a route like '/status/{id}', you can capture the ID via $request['id']. Parameters are defined in the 'args' array, where you can specify validation rules like 'required' and 'sanitize_callback'. More importantly, you must set up a 'permission_callback' – this is essential for security. Without it, anyone could access your endpoint anonymously. You can use a simple permission check like 'return current_user_can( 'edit_posts' );' or something more complex involving nonces and API keys. Always validate and sanitize inputs to prevent SQL injection or XSS attacks.
Testing and Debugging Your Endpoint
Once your endpoint is registered, you need to test it. The easiest way is to use a tool like Postman or Insomnia, or simply a browser for GET requests. For a URL like http://yoursite.co.uk/wp-json/myplugin/v1/status, you should see a JSON response. If you get a 404 error, check that your permalinks are flushed. If you get a 401 or 403, your permission_callback is blocking the request – adjust it accordingly. For debugging, you can use WP_DEBUG and error_log() inside your callback. Also, consider using the WP_REST_Response class to control the status code and headers. For UK developers, it's worth testing on both PHP and WordPress versions, and using tools like Query Monitor to trace what's happening. Add unit tests with the WP REST API test framework for robust code.
Practical UK Examples and Best Practices
Let's look at a practical UK example: a restaurant website that needs an endpoint to check if a table is available for a specific date and time. You might register a route like '/reservations/availability' that accepts 'date' and 'time' parameters. The callback queries your booking database and returns true or false. Best practices include using a proper namespace, versioning your API (e.g., /v1, /v2), and documenting your endpoints – many UK agencies use OpenAPI specs. Always cache responses where possible to reduce server load, especially for publicly accessible data. Also, ensure your endpoints are secure by using HTTPS and proper authentication, like a WordPress nonce for logged-in users or an application password for external clients. Follow these guidelines and you'll create endpoints that are reliable and maintainable.
FAQ
An endpoint is a specific URL within the WordPress REST API that you can send requests to. It corresponds to a function that retrieves or modifies data. For example, /wp-json/wp/v2/posts is an endpoint that returns a list of posts. Custom endpoints allow you to define your own URLs and data handling rules.