A custom post type registered without show_in_rest opens in the classic editor even on 5.0, silently, because the new editor has no way to load or save it.…
permission_callback was optional until recently and defaulting it to __return_true is the same as having no authorisation at all, which is how endpoints intended for the admin end…
Adding data to an existing REST response by filtering the prepared object is tempting and is the wrong hook — there is a registration function that also documents…
Disabling the REST API with a filter that returns an error for unauthenticated requests was a common hardening step, and on 5.0 it breaks the editor completely. The…
Plugins offering to “disable the REST API” hook rest_authentication_errors and return an error for unauthenticated requests, which is a restriction rather than a removal — the routes still…
Registering a route under wp/v2 puts it in core’s namespace, where a future core route can collide with it and where nothing signals that it is yours. The…
The schema attached to a route looks like a description for humans. Core uses it to validate and sanitise the request before the callback runs, which means an…
Adding a field to a core REST response means either filtering the prepared object, which is fragile, or registering the field properly so it appears in the schema…
Options registered with register_setting() can now appear on /wp/v2/settings, which turns a plugin’s configuration into something an admin interface elsewhere can read and write without a bespoke endpoint.…