Title: WP REST API: Merge Proposal Author: Ryan McCue Published: September 21, 2015 Last modified: October 7, 2015 --- [ ](https://profiles.wordpress.org/rmccue/) [Ryan McCue](https://profiles.wordpress.org/rmccue/) 1:03 am _on_ September 21, 2015 Tags: [feature plugins ( 122 )](https://make.wordpress.org/core/tag/feature-plugins/), [json-api ( 39 )](https://make.wordpress.org/core/tag/json-api/), [merge ( 11 )](https://make.wordpress.org/core/tag/merge/), [proposal ( 40 )](https://make.wordpress.org/core/tag/proposal/), [rest-api ( 111 )](https://make.wordpress.org/core/tag/rest-api/) # WP REST API: Merge Proposal Hello everyone! This is the post you’ve all been waiting for. 🙂 We on the REST APIREST API The REST API is an acronym for the RESTful Application Program Interface (API) that uses HTTP requests to GET, PUT, POST and DELETE data. It is how the front end of an application (think “phone app” or “website”) can communicate with the data store (think “database” or “file system”) [https://developer.wordpress.org/rest-api/](https://developer.wordpress.org/rest-api/) team (myself, [@rachelbaker](https://profiles.wordpress.org/rachelbaker/), [@joehoyle](https://profiles.wordpress.org/joehoyle/), [@danielbachhuber](https://profiles.wordpress.org/danielbachhuber/), and newest member and coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. committercommitter A developer with commit access. WordPress has five lead developers and four permanent core developers with commit access. Additionally, the project usually has a few guest or component committers- a developer receiving commit access, generally for a single release cycle (sometimes renewed) and/or for a specific component. [@pento](https://profiles.wordpress.org/pento/)) would like to propose merging the REST API into WordPress core. We’ve been working a while on this, and think it’s now ready to get your feedback. This is our first iteration of the proposal, and we’re actively looking for feedback. If you have thoughts on the project, or on this proposal, let us know! Only with your feedback can we make progress. 🙂 ## What is the REST API? The REST API is a nice and easy way to get at your data in WordPress externally, whether that’s from JavaScriptJavaScript JavaScript or JS is an object-oriented computer programming language commonly used to create interactive effects within web browsers. WordPress makes extensive use of JS for a better user experience. While PHP is executed on the server, JS executes within a user’s browser. [https://www.javascript.com](https://www.javascript.com/) in a theme or pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party., mobile and desktop applications, or importing and exporting data. The APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways. offers up all core data types (posts, terms comments, and users), plus support for metaMeta Meta is a term that refers to the inside workings of a group. For us, this is the team that works on internal WordPress sites like WordCamp Central and Make WordPress. and revisionsRevisions The WordPress revisions system stores a record of each saved draft or published update. The revision system allows you to see what changes were made in each revision by dragging a slider (or using the Next/Previous buttons). The display indicates what has changed in each revision.; we’ve got plans to eventually have access to everything the adminadmin (and super admin) and frontend have access to. The REST API differs from existing WordPress APIs in that it is explicitly designed from the ground up for modern mobile and browser usage, using the lightweight and widely-supported JSONJSON JSON, or JavaScript Object Notation, is a minimal, readable format for structuring data. It is used primarily to transmit data between a server and web application, as an alternative to XML. data serialization format with a modern REST interface. Both of these are already familiar to most developers: JSON is a subset of JavaScript intended purely as a data interchange format, and REST is a set of best practices around HTTPHTTP HTTP is an acronym for Hyper Text Transfer Protocol. HTTP is the underlying protocol used by the World Wide Web and this protocol defines how messages are formatted and transmitted, and what actions Web servers and browsers should take in response to various commands.. Both are supported natively by almost every programming language and platform. ## Why do we need a new API? WordPress already has external APIs: XML-RPC, designed for desktop clients; Atom and RSS feeds, designed for post syndication; and the venerable admin-ajax, designed for Ajax requests in the admin and frontend. These APIs all serve different purposes, but often have a great deal of overlap. In addition, these have all been stretched beyond their original intentions: XML-RPC now contains site management tools, RSS has been extended into the WXR export format, and admin-ajax is the catch-all of any sort of browser-server communication in plugins and themes. The REST API builds upon the heritage of these APIs to provide better support today for using these, as well as laying the groundwork for expanded use in the future. XML-RPC is the closest analogue to the REST API in terms of usage and capabilitiescapability A **capability** is permission to perform one or more types of task. Checking if a user has a capability is performed by the `current_user_can` function. Each user of a WordPress site might have some permissions but not others, depending on their role. For example, users who have the Author role usually have permission to edit their own posts (the “edit_posts” capability), but not permission to edit other users’ posts (the “edit_others_posts” capability).. Originally designed back in 1998 to allow desktop clients to create and edit posts on blogs, WordPress has extended this with both other specifications (such as MetaWeblog) and with its own proprietary additions. Fundamentally, XML-RPC is built around Remote Procedure Calls (RPC), essentially a way of calling a function externally. It then uses XML to serialize the data for passing back and forth. Unfortunately, XML serialization can be problematic at times. XML has lots of power, but support for custom entities and DOCTYPEs can cause parsing problems and security attacks, including billion laughs, and XXE exploits. (Currently, WordPress has to disable parts of the XML parser and apply regular expression replacements to be able to parse these safely.) XML is also very verbose, and represents data in a way which doesn’t map easily to programmatic data structures. JSON on the other hand is both concise and well-represented in memory, as it’s based on JavaScript’s native syntax. The `admin-ajax` API is also very commonly used in WordPress, albeit typically only by plugins and themes. This is a very lightweight API that essentially acts as a mini-router. Typical usage of this API uses JSON, since it’s a browser-based API, but all usage is completely custom. A lot of the usage of this involves retrieving or updating posts on-the-fly, but due to its nature as simply a framework, these are done in completely different ways. This doesn’t lead itself to extensibility, and requires a lot of duplication every time developers want to get data in or out. We don’t want to replace all of `admin-ajax` though, since some use cases don’t map exactly: UIUI User interface-related interactions or things like the Heartbeat API are great examples of this. The REST API can help to supplant these uses. Our aim is to eventually replace the XML-RPC API completely, to act as a secondary import/export format, and to replace most (but not all) uses of admin-ajax. The REST API offers an easier to use interface than the existing solutions. ## Why this project? We’ve been working on this project ever since the first WordPress Contributor Summit back in 2012. Since then, we’ve had lots of feedback from core developers, the community at large, and further beyond in the form of client developers. We believe that the REST API has an immense amount of experience behind it, and plenty of viewpoints have contributed to the project’s direction. The API has seen great usage in the community, from various mobile apps to large news sites. This usage has helped to battle-test and prove out the API. In the process, we’ve found plenty of bugs, and some security issues. Thanks to this feedback, the API is incredibly stable and secure. (The most recent security bugs we fixed were relatively minor bugs.) We also designed the API from the ground-up to be part of core, following a core- like mentality to our processes. The API is intended to be both a great feature and a base to build off in plugins. We undertook a significant refactoring and partial rewrite in version 2 to make this extensibility even better. This open process also means that most of the design decisions are documented publicly as we’ve engaged stakeholders to gauge feedback. We believe these pieces combined make this a fantastic feature for WordPress core, and we hope you all agree. 🙂 ## What’s the plan? The plan we’re aiming for is a two part merge of the API. For the first stage, the infrastructure code would be merged into `wp-includes` and made available for plugins and themes. This is an internal API only, but offers an “API construction kit” for developers to use. For the second stage, the endpoints would be merged, and the API would be enabled for sites by default. This plan splits the API into two parts, infrastructure and endpoints: * **Stage One: Infrastructure**: The infrastructure is the code responsible for routing requests and handling the “meta” layer of the API, including JSON serialisation/ deserialisation, linking, embedding, and REST best practices. This adds a simplified routing layer outside of WP’s rewrites, allowing non-query-var rewrites easily, acting as a base for building APIs inside WordPress. * **Stage Two: Endpoints**: These are where much of the complexity of the API lies, as they’re responsible for mapping data from the external JSON format to the internal data structures, and vice versa. The “business” logic of integrating with WordPress is almost entirely contained within the endpoints. These are the more complex part of the API, as they require using deep APIs in WordPress, and handling security and privacy concerns. With this plan, we would aim to have the infrastructure merged in 4.4, and the endpoints merged one release later in 4.5. The slow nature of this plan allows a longer review time on the API for core committers. It also gives extra time for reviewing the endpoints, since they would be delayed one release. Merging the infrastructure now would allow third-party code to begin using the API to build upon it, including migrating from existing custom code. It would also help to increase developer confidence in the API (as it represents a commitment by the project towards a REST API). In this plan, the first stage would not include any of the base controllers (such as the posts controller). This may limit the utility of the infrastructure for plugins and themes, however as the endpoints would be merged a cycle later, it’s expected that this wouldn’t have a huge impact. The infrastructure of the API is approximately 2700 lines of codeLines of Code Lines of code. This is sometimes used as a poor metric for developer productivity, but can also have other uses. (roughly a third of the API codebase), and the endpoints make up the remaining 5500 lines of code. ## What would happen after merge? After merging the REST API into core, we’d spend approximately two weeks partying and celebrating. 🙂 Once we’re done with the parties, one major question would be how we manage the API in the future. The existing management and contribution process via GitHubGitHub GitHub is a website that offers online implementation of git repositories that can easily be shared, copied and modified by other developers. Public repositories are free to host, private repositories require a paid subscription. GitHub introduced the concept of the ‘pull request’ where code changes done in branches by contributors can be reviewed and discussed before being merged by the repository owner. [https://github.com/](https://github.com/) has been extremely successful, as we’ve had 61 people’s pull requests merged into the API. Contribution via GitHub is especially useful for the API, as it’s a heavily developer-focussed project, and is aimed at external (non-WordPress) developers. On the other hand, all other contribution to WordPress is done via SVNSVN Subversion, the popular version control system (VCS) by the Apache project, used by WordPress to manage changes to its codebase. and TracTrac An open source project by Edgewall Software that serves as a bug tracker and project management tool for WordPress., so integrating with this process is important for existing developers, as well as core’s general processes. We need to ensure the API is an integral part of core, not a separate project. Given the team’s experience with GitHub as well as Trac, we can bring the best of both worlds by helping integrate the two. This would also improve contribution for WordPress as a whole, and benefit the whole community. This will be especially important as we encourage more contributions from the wider community (client authors, for example). We think we can make good progress here, and we’d love to try and help improve the process. 🙂 In addition to the project management, there are still further API projects we need to tackle. Authentication is the most important of these, as a huge focus on OAuth and similar would be needed to make the API more useful for external clients. Currently, we haven’t had enough time to spend on this as well as managing the API project, however the API is now reaching a finalised stage, so this should be able to improve quickly. Centralised authentication is a huge part of this, as the regular OAuth registration process is cumbersome for a distributed system like WordPress. Important note: We don’t believe authentication is required for the API merge, and we treat it as a separate project. The authentication is a completely separate system to the API itself. This is something we’d give more time to in the future, but we want to focus on shipping the API for now. ## Let’s go! This is our merge plan for the API, however it’s not finalised. If you’ve got comments, thoughts, suggestions, opinions, or words of encouragement, let us know. We’d love to know what you think. Thank you all, you’re wonderful, and stay golden. [#feature-plugins](https://make.wordpress.org/core/tag/feature-plugins/), [#json-api](https://make.wordpress.org/core/tag/json-api/), [#merge](https://make.wordpress.org/core/tag/merge/), [#proposal](https://make.wordpress.org/core/tag/proposal/), [#rest-api](https://make.wordpress.org/core/tag/rest-api/) ### Share this: * [ Threads ](https://make.wordpress.org/core/2015/09/21/wp-rest-api-merge-proposal/?share=threads) * [ Mastodon ](https://make.wordpress.org/core/2015/09/21/wp-rest-api-merge-proposal/?share=mastodon) * [ Bluesky ](https://make.wordpress.org/core/2015/09/21/wp-rest-api-merge-proposal/?share=bluesky) * [ X ](https://make.wordpress.org/core/2015/09/21/wp-rest-api-merge-proposal/?share=x) * [ Facebook ](https://make.wordpress.org/core/2015/09/21/wp-rest-api-merge-proposal/?share=facebook) * [ LinkedIn ](https://make.wordpress.org/core/2015/09/21/wp-rest-api-merge-proposal/?share=linkedin) 1. ![](https://secure.gravatar.com/avatar/0608b540c7da83b396fd9a453ad1ac0298152522bc3a06888d41649e4024a089? s=32&d=mm&r=g) 2. [Ahmad Awais](https://profiles.wordpress.org/mrahmadawais/) 3:13 am _on_ September 21, 2015 3. “After merging the REST APIREST API The REST API is an acronym for the RESTful Application Program Interface (API) that uses HTTP requests to GET, PUT, POST and DELETE data. It is how the front end of an application (think “phone app” or “website”) can communicate with the data store (think “database” or “file system”) [https://developer.wordpress.org/rest-api/](https://developer.wordpress.org/rest-api/) into coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress., we’d spend approximately two weeks partying and celebrating.” 🎉✨💥 Just like that 🙂 Hoping for REST API to get merged as soon as possible. 4. ![](https://secure.gravatar.com/avatar/6845456dbc9056f20a4cd50a6b95db78f2ae31df5c0601c613ee5b8939c41a82? s=32&d=mm&r=g) 5. [Jon Brown](https://profiles.wordpress.org/jb510/) 3:37 am _on_ September 21, 2015 6. One the one hand this can’t happen too soon or too fast… on the other hand I understand the slow and staged approach. 7. I’ve never seen it happen but would it be feasible to merge it into coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. and flag it as “betaBeta A pre-release of software that is given out to a large group of users to trial under real conditions. Beta versions have gone through alpha testing in-house and are generally fairly close in look, feel and function to the final product; however, design changes often occur as part of the process.” for a release? I know that wouldn’t be “normal” but then this big of a merge hasn’t happened in a long while and I’m just wondering if something like that was considered? 8. The GitHubGitHub GitHub is a website that offers online implementation of git repositories that can easily be shared, copied and modified by other developers. Public repositories are free to host, private repositories require a paid subscription. GitHub introduced the concept of the ‘pull request’ where code changes done in branches by contributors can be reviewed and discussed before being merged by the repository owner. [https://github.com/](https://github.com/) issue is a big one and I’m glad you touched on it, but I’m entirely unclear what you’re actually proposing here going forward? Are APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways. devs going to continue to have a way to contribute via GitHub post merge? 9. * ![](https://secure.gravatar.com/avatar/c21ff90e030a07e3a20f48a0496530828cf86ef69a464d326351423eb2570ef0? s=32&d=mm&r=g) * [Ryan McCue](https://profiles.wordpress.org/rmccue/) 3:51 am _on_ September 21, 2015 * > I’ve never seen it happen but would it be feasible to merge it into coreCore > Core is the set of software required to run WordPress. The Core Development > Team builds WordPress. and flag it as “betaBeta A pre-release of software > that is given out to a large group of users to trial under real conditions. > Beta versions have gone through alpha testing in-house and are generally > fairly close in look, feel and function to the final product; however, design > changes often occur as part of the process.” for a release? * I believe the Heartbeat APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways. was handled this way, but I can’t speak as to whether it’d be feasible here; that’s something for the core team to consider. 🙂 * > Are API devs going to continue to have a way to contribute via GitHubGitHub > GitHub is a website that offers online implementation of git repositories > that can easily be shared, copied and modified by other developers. Public > repositories are free to host, private repositories require a paid subscription. > GitHub introduced the concept of the ‘pull request’ where code changes done > in branches by contributors can be reviewed and discussed before being merged > by the repository owner. [https://github.com/](https://github.com/) post > merge? * The plan would be that the API will become an integral part of core, and that contributing to the API would be just like contributing to WordPress. However, we’d like to help people contribute to WP via GitHub, which would allow contributions to the API (or any other part of core) via GitHub. 🙂 - ![](https://secure.gravatar.com/avatar/67c29b1c856079e9bac1ad3b97d9077abdc21b90ac0b4fee88508363b1167b6b? s=32&d=mm&r=g) - [borekb](https://profiles.wordpress.org/borekb/) 7:02 am _on_ September 21, 2015 - > However, we’d like to help people contribute to WP via GitHubGitHub GitHub is a website that offers online implementation of git repositories that can easily be shared, copied and modified by other developers. Public repositories are free to host, private repositories require a paid subscription. GitHub introduced the concept of the ‘pull request’ where code changes done in branches by contributors can be reviewed and discussed before being merged by the repository owner. [https://github.com/](https://github.com/), which would allow contributions to the APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways. (or any other part of coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress.) via GitHub. 🙂 - Yes yes yes! That would be a nice by-product of the API project 🙂 * ![](https://secure.gravatar.com/avatar/e522019adbe7cb4145f9e01c344c036baaa8bf76cd5d76e6b737b60be9af88cc? s=32&d=mm&r=g) * [Gary Pendergast](https://profiles.wordpress.org/pento/) 3:56 am _on_ September 21, 2015 * > The GitHubGitHub GitHub is a website that offers online implementation of > git repositories that can easily be shared, copied and modified by other > developers. Public repositories are free to host, private repositories require > a paid subscription. GitHub introduced the concept of the ‘pull request’ > where code changes done in branches by contributors can be reviewed and > discussed before being merged by the repository owner. [https://github.com/](https://github.com/) > issue is a big one and I’m glad you touched on it, but I’m entirely unclear > what you’re actually proposing here going forward? Are APIAPI An API or > Application Programming Interface is a software intermediary that allows > programs to interact with each other and share data in limited, clearly > defined ways. devs going to continue to have a way to contribute via GitHub > post merge? * To add to [@rmccue](https://profiles.wordpress.org/rmccue/)‘s comments – the REST APIREST API The REST API is an acronym for the RESTful Application Program Interface (API) that uses HTTP requests to GET, PUT, POST and DELETE data. It is how the front end of an application (think “phone app” or “website”) can communicate with the data store (think “database” or “file system”) [https://developer.wordpress.org/rest-api/](https://developer.wordpress.org/rest-api/) team already have a well established workflow in GitHub. We’d like to experiment with combining their workflow with an (as yet undecided) method for syncing Pull Requests with TracTrac An open source project by Edgewall Software that serves as a bug tracker and project management tool for WordPress. tickets. * By experimenting with a small part of WordPress, we can hopefully create a model that could be expanded to work for the entire WordPress project. 10. ![](https://secure.gravatar.com/avatar/43e29d085557263eeeefcf36af08404a9349c9c15099d6bf1fe9d24af3c5ca41? s=32&d=mm&r=g) 11. [kstover](https://profiles.wordpress.org/kstover/) 3:47 am _on_ September 21, 2015 12. +1 13. We’re currently re-writing the moderately successful Ninja Forms pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress. org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. using primarily Backbone, and this would be amazing for our plugin. As you say in the proposal, we currently have to stretch adminadmin (and super admin)-ajax.php to the limit. 14. Hoping this happens! 15. ![](https://secure.gravatar.com/avatar/8b8f5607075ef3e0f9b8695a936778edd0da69b682843d4a6237734e33926fda? s=32&d=mm&r=g) 16. [kdpuvvadi](https://profiles.wordpress.org/kdpuvvadi/) 3:59 am _on_ September 21, 2015 17. what happens to the releases on githubGitHub GitHub is a website that offers online implementation of git repositories that can easily be shared, copied and modified by other developers. Public repositories are free to host, private repositories require a paid subscription. GitHub introduced the concept of the ‘pull request’ where code changes done in branches by contributors can be reviewed and discussed before being merged by the repository owner. [https://github.com/](https://github.com/), what pull requests and issues? will you handle those? 18. * ![](https://secure.gravatar.com/avatar/c21ff90e030a07e3a20f48a0496530828cf86ef69a464d326351423eb2570ef0? s=32&d=mm&r=g) * [Ryan McCue](https://profiles.wordpress.org/rmccue/) 4:56 am _on_ September 21, 2015 * See comments above on how we want to handle GitHubGitHub GitHub is a website that offers online implementation of git repositories that can easily be shared, copied and modified by other developers. Public repositories are free to host, private repositories require a paid subscription. GitHub introduced the concept of the ‘pull request’ where code changes done in branches by contributors can be reviewed and discussed before being merged by the repository owner. [https://github.com/](https://github.com/) integration. The existing issues on our tracker will either be migrated over, or closed out. 19. ![](https://secure.gravatar.com/avatar/6dba66de73d09f673806e6301e633651cc0814a75ce87341b5798f81e7bc5bce? s=32&d=mm&r=g) 20. [Ionel Roiban](https://profiles.wordpress.org/wpdeveloper/) 4:31 am _on_ September 21, 2015 21. Ggreat news. Where is the APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways. documented? 22. * ![](https://secure.gravatar.com/avatar/c21ff90e030a07e3a20f48a0496530828cf86ef69a464d326351423eb2570ef0? s=32&d=mm&r=g) * [Ryan McCue](https://profiles.wordpress.org/rmccue/) 4:56 am _on_ September 21, 2015 * Documentation for version 2 is available at [http://v2.wp-api.org/](http://v2.wp-api.org/)– We’re working on improving this as well 🙂 23. ![](https://secure.gravatar.com/avatar/62fac6382cb12d70a6dc0af2858a433ecf0f40fcc9a4523053b0615bb038b330? s=32&d=mm&r=g) 24. [markkaplun](https://profiles.wordpress.org/markkaplun/) 5:08 am _on_ September 21, 2015 25. +0.5 for inclusion, but the only reason is that is serves as a wrapper to Alax APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways. which can speed up AJAX related development. 26. OTOH I am still trying to find what does the RST API does that a seasoned developer can’t easily do by himself with the AJAX API.. It is not a replacement to XML- RPC as XML-RPC is a standard adopted by all major platforms and therefor do not required 3rd party (lts say flickr) an extra effort to support different platforms( another more popular usage is trackbacks). With the REST APIREST API The REST API is an acronym for the RESTful Application Program Interface (API) that uses HTTP requests to GET, PUT, POST and DELETE data. It is how the front end of an application (think “phone app” or “website”) can communicate with the data store( think “database” or “file system”) [https://developer.wordpress.org/rest-api/](https://developer.wordpress.org/rest-api/), it is a wordpress specific thing and to be used by a 3rd party an extra development will be required. 27. So the question is why do we need a 4rd way to do computer to computer communication, what is the use case that make the REST aPI shine, something that either impossible or is just so much better then doing it with other protocols? Right now caching of AJAX requests is the only thing I can come up with and that is the reason for the “include but the feature is a meh” above. 28. * ![](https://secure.gravatar.com/avatar/c21ff90e030a07e3a20f48a0496530828cf86ef69a464d326351423eb2570ef0? s=32&d=mm&r=g) * [Ryan McCue](https://profiles.wordpress.org/rmccue/) 5:59 am _on_ September 21, 2015 * > I am still trying to find what does the RST APIAPI An API or Application > Programming Interface is a software intermediary that allows programs to > interact with each other and share data in limited, clearly defined ways. > does that a seasoned developer can’t easily do by himself with the AJAX > API. * The REST APIREST API The REST API is an acronym for the RESTful Application Program Interface (API) that uses HTTP requests to GET, PUT, POST and DELETE data. It is how the front end of an application (think “phone app” or “website”) can communicate with the data store (think “database” or “file system”) [https://developer.wordpress.org/rest-api/](https://developer.wordpress.org/rest-api/) is a much simpler API for interacting with, and doesn’t have a lot of the problems that XML-RPC does (although it has problems of its own). It’s typically much easier and faster to work with on almost every platform, and it’s a bunch less data that needs to be sent over the wire, which is especially important for mobile applications. * The XML-RPC we have currently is actually significantly custom to WordPress: XML-RPC is just a standard for an over-the-wire API (similar to REST). The actual APIs for blogging are Blogger, MetaWeblog, Movable Type, and WordPress.( Plus the pingbackPingback A pingback is a special type of comment that's created when you link to another blog post, as long as the other blog is set to accept pingbacks. Pingback allows you to notify other bloggers that you have linked to their article on your website. Although there are some minor technical differences, a trackback is basically the same thing as a pingback. API.) MetaWeblog is the only actually standard API, but offers very limited utility, which is why the others exist. * That said, XML-RPC is going nowhere in the short term. It’s still very useful due to compatibility, although I wouldn’t recommend creating a new client using it, due to the complexity. * > a seasoned developer can’t easily do by himself * Just to note: there are plenty of female developers, so “themselves” would be a better pronoun to use. 🙂 - ![](https://secure.gravatar.com/avatar/62fac6382cb12d70a6dc0af2858a433ecf0f40fcc9a4523053b0615bb038b330? s=32&d=mm&r=g) - [markkaplun](https://profiles.wordpress.org/markkaplun/) 4:33 pm _on_ September 21, 2015 - I think you avoided the main question of use case in which the APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways. shines. The problem with not having a use case is that without one it is impossible to compare if an full REST APIREST API The REST API is an acronym for the RESTful Application Program Interface( API) that uses HTTP requests to GET, PUT, POST and DELETE data. It is how the front end of an application (think “phone app” or “website”) can communicate with the data store (think “database” or “file system”) [https://developer.wordpress.org/rest-api/](https://developer.wordpress.org/rest-api/) is better then some other APIs, or maybe the main benefits can be achieved by some wrapper around the Ajax and rewrite APIs without the added bloat and increasing the attack surface. - For example a simple use case is a scrolling news feed which refreshes every 10 minutes.With what I see in the API for each new post I will have to do 2 request, one getting the post and another getting the featured imageFeatured image A featured image is the main image used on your blog archive page and is pulled when the post or page is shared on social media. The image can be used to display in widget areas on your site or in a summary list of posts.. If I will code it by myself it will do it in one request. The difference between 1 and 2 requests can be the difference between shared hosting and VPS. Another variation of the same problem is that AFAICT post metaMeta Meta is a term that refers to the inside workings of a group. For us, this is the team that works on internal WordPress sites like WordCamp Central and Make WordPress. is not retturned as part of the post request, why is that? - The point is that the API is huge and every piece of it should be justified IMHO before added to coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress.. 90% (made up the number by myself!) of wordpress sites are not going to use this functionality in any way, at least not before the IOS and android apps will be changed to use it, so why should this bloat be added to core? - as for male/female thing I can go into how ridiculous it is to expect people that english is not their mother tongue to use english correctly and be aware to all the small cultural assumption behind each word, but I am not PC Principal (people who do not watch south park should be ashamed of themselves) * ![](https://secure.gravatar.com/avatar/5db2e6f9d813e0e0ded1526b8dc59c17c8af532ddb2634bfe9ab09711b9bc8b4? s=32&d=mm&r=g) * [Pete Nelson](https://profiles.wordpress.org/gungeekatx/) 6:32 pm _on_ September 21, 2015 * Using the rest_prepare_post filterFilter Filters are one of the two types of Hooks [https://codex.wordpress.org/Plugin_API/Hooks](https://codex.wordpress.org/Plugin_API/Hooks). They provide a way for functions to modify data of other functions. They are the counterpart to Actions. Unlike Actions, filters are meant to work in an isolated manner, and should never have side effects such as affecting global variables and output., you can add featured imageFeatured image A featured image is the main image used on your blog archive page and is pulled when the post or page is shared on social media. The image can be used to display in widget areas on your site or in a summary list of posts. details to each post, thus preventing a round-trip to the server on the front-end. Could also be used for post metaMeta Meta is a term that refers to the inside workings of a group. For us, this is the team that works on internal WordPress sites like WordCamp Central and Make WordPress.. * Here’s a link to the relevant slide from a talk I did at WordCampWordCamp WordCamps are casual, locally-organized conferences covering everything related to WordPress. They're one of the places where the WordPress community comes together to teach one another what they’ve learned throughout the year and share the joy. [Learn more](https://central.wordcamp.org/about/). DFW on extending the REST APIREST API The REST API is an acronym for the RESTful Application Program Interface (API) that uses HTTP requests to GET, PUT, POST and DELETE data. It is how the front end of an application( think “phone app” or “website”) can communicate with the data store ( think “database” or “file system”) [https://developer.wordpress.org/rest-api/](https://developer.wordpress.org/rest-api/): [https://docs.google.com/presentation/d/1o4gJnEcq1vbDUsjZu_zRfh8D7crxzU45gTCquZOFODw/edit?pli=1#slide=id.ga423abea2_1_61](https://docs.google.com/presentation/d/1o4gJnEcq1vbDUsjZu_zRfh8D7crxzU45gTCquZOFODw/edit?pli=1#slide=id.ga423abea2_1_61) - ![](https://secure.gravatar.com/avatar/62fac6382cb12d70a6dc0af2858a433ecf0f40fcc9a4523053b0615bb038b330? s=32&d=mm&r=g) - [markkaplun](https://profiles.wordpress.org/markkaplun/) 5:54 am _on_ September 22, 2015 - But this requires me to write a pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. that has to be installed server side, and them my JSJS JavaScript, a web scripting language typically executed in the browser. Often used for advanced user interfaces and behaviors. is not compatible to other wordpress sites, so except for saving some coding what is the difference from now? - I think your comment helped me to understand my own position. I fully on board with using the coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. code of the plugin in core in order to make it easier to deployDeploy Launching code from a local development environment to the production web server, so that it's available to visitors. jsonJSON JSON, or JavaScript Object Notation, is a minimal, readable format for structuring data. It is used primarily to transmit data between a server and web application, as an alternative to XML. based REST APIREST API The REST API is an acronym for the RESTful Application Program Interface( API) that uses HTTP requests to GET, PUT, POST and DELETE data. It is how the front end of an application (think “phone app” or “website”) can communicate with the data store (think “database” or “file system”) [https://developer.wordpress.org/rest-api/](https://developer.wordpress.org/rest-api/), but I don’t think that the current endpoints are fully baked, it seems like they return too much internal information which no one should know about except for the adminadmin (and super admin) (like list of post types) but also not sure that they give enough information for the most common use cases. * ![](https://secure.gravatar.com/avatar/055a475f0e7cd52a4bb515d139456e8cdd1aab6dfc7e9e9cfdb5e066f000367b? s=32&d=mm&r=g) * [Matthew Eppelsheimer](https://profiles.wordpress.org/mattheweppelsheimer/) 11:42 pm _on_ September 21, 2015 * I think the key point here is that nearly anything developers can do with XML-RPC or adminadmin (and super admin)-ajax APIs, they can do more easily with the JSONJSON JSON, or JavaScript Object Notation, is a minimal, readable format for structuring data. It is used primarily to transmit data between a server and web application, as an alternative to XML. REST APIREST API The REST API is an acronym for the RESTful Application Program Interface (API) that uses HTTP requests to GET, PUT, POST and DELETE data. It is how the front end of an application( think “phone app” or “website”) can communicate with the data store ( think “database” or “file system”) [https://developer.wordpress.org/rest-api/](https://developer.wordpress.org/rest-api/). So it shines across the board, for many use cases. * The iOSiOS The operating system used on iPhones and iPads. and Android apps can’t start to use this until it is in coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress.. Core itself, and default themes, will also likely use the APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways. in the future. So someday, most and perhaps even all WordPress installations will eventually use the API. - ![](https://secure.gravatar.com/avatar/62fac6382cb12d70a6dc0af2858a433ecf0f40fcc9a4523053b0615bb038b330? s=32&d=mm&r=g) - [markkaplun](https://profiles.wordpress.org/markkaplun/) 6:14 am _on_ September 22, 2015 - IOS and android apps will keep using XML-RPC as long as there will be sites that use WP versions 4.3 and below, which is years in the future, and even then why would they rewrite the code for no actual benefit? There is nothing wrong with XML-RPC except for being old and XML note being hype anymore. - I am not even sure that there is a parity in capabilitiescapability A **capability** is permission to perform one or more types of task. Checking if a user has a capability is performed by the `current_user_can` function. Each user of a WordPress site might have some permissions but not others, depending on their role. For example, users who have the Author role usually have permission to edit their own posts ( the “edit_posts” capability), but not permission to edit other users’ posts (the “edit_others_posts” capability). of both protocols right now (doesn’t seem like there is an end point for options). - ![](https://secure.gravatar.com/avatar/c21ff90e030a07e3a20f48a0496530828cf86ef69a464d326351423eb2570ef0? s=32&d=mm&r=g) - [Ryan McCue](https://profiles.wordpress.org/rmccue/) 1:12 am _on_ September 23, 2015 - > IOS and android apps will keep using XML-RPC as long as there will > be sites that use WP versions 4.3 and below - The iOSiOS The operating system used on iPhones and iPads. and Android apps only currently support 3.6 and 3.5 respectively, so they do have the ability to move faster. In addition, you can progressively support the APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways., with an XML- RPC fallback if you want. * ![](https://secure.gravatar.com/avatar/c21ff90e030a07e3a20f48a0496530828cf86ef69a464d326351423eb2570ef0? s=32&d=mm&r=g) * [Ryan McCue](https://profiles.wordpress.org/rmccue/) 1:08 am _on_ September 23, 2015 * One of the key benefits of the APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways. is that it can remove the need to write anything at all on the server. In addition, data’s provided in a standard way across the wire, making it much easier for plugins to extend. Right now, custom bespoke APIs are unlikely to work across the board with plugins, or even with the edge cases in coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress.. (For example, handling password protected posts is super painful right now.) * > With what I see in the API for each new post I will have to do 2 request, > one getting the post and another getting the featured imageFeatured > image A featured image is the main image used on your blog archive > page and is pulled when the post or page is shared on social media. > The image can be used to display in widget areas on your site or in > a summary list of posts.. * For the specific example here, try adding `?_embed` to your request, and you’ll get back the linked resources as well. [http://v2.wp-api.org/extending/linking/](http://v2.wp-api.org/extending/linking/) has more detail on that. * > Another variation of the same problem is that AFAICT post metaMeta > Meta is a term that refers to the inside workings of a group. For > us, this is the team that works on internal WordPress sites like WordCamp > Central and Make WordPress. is not retturned as part of the post request, > why is that? * Answered below; see [https://github.com/WP-API/WP-API/issues/1425](https://github.com/WP-API/WP-API/issues/1425) for why the current situation is what it is, and what our plans are for improving it. * > The point is that the API is huge and every piece of it should be > justified IMHO before added to core. 90% (made up the number by myself!) > of wordpress sites are not going to use this functionality * We can almost immediately begin removing custom Ajax handlers in the adminadmin (and super admin), such as the code that handles trashing comments. `wp-admin/includes/ajax-actions.php` might be able to disappear entirely (fingers crossed), and that single file is ~3000 lines just by itself. * If we can replace all of this code with well-tested code, I think it’s already worth it. * ![](https://secure.gravatar.com/avatar/27180c82524020e7339e2b30818b6d8ab004c54f730f12b1434b1e365be0e175? s=32&d=mm&r=g) * [Ipstenu (Mika Epstein)](https://profiles.wordpress.org/ipstenu/) 1:32 pm _on_ September 22, 2015 * The xmlrpc approach is heavily targeted by ddosDistributed Denial of Service A type of online attack where a large number of infected computers are used to overwhelm a target computer, to the point where it no longer has the resources to perform its normal job. [Read more](https://en.wikipedia.org/wiki/Denial-of-service_attack#Distributed_attack). and brute force attacks, which makes it rather undesireable. From a host standpoint, we hate it 🙂 * [https://blog.sucuri.net/2014/07/new-brute-force-attacks-exploiting-xmlrpc-in-wordpress.html](https://blog.sucuri.net/2014/07/new-brute-force-attacks-exploiting-xmlrpc-in-wordpress.html) Just as an example. * While not all the issues go away with this, enough do that I welcome our new restful overlords. 29. ![](https://secure.gravatar.com/avatar/27af162a09dc4e92cca0c3d8353c3afdae7a2164597f63f6664657f198e5d27f? s=32&d=mm&r=g) 30. [Daniel Homer](https://profiles.wordpress.org/danielhomer/) 7:03 am _on_ September 21, 2015 31. This is fantastic news, thanks to everyone involved! A standardised APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways. in coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. will simplify a lot of JSJS JavaScript, a web scripting language typically executed in the browser. Often used for advanced user interfaces and behaviors. logic in plugins and will pave the way for more advanced web apps on top of WordPress. 32. 🎉 33. ![](https://secure.gravatar.com/avatar/67c29b1c856079e9bac1ad3b97d9077abdc21b90ac0b4fee88508363b1167b6b? s=32&d=mm&r=g) 34. [borekb](https://profiles.wordpress.org/borekb/) 7:05 am _on_ September 21, 2015 35. What will be the story for plugins that opt to use the APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways. but also need to support 4.3 and below? Will there be a compat pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost- based plugin from a third-party. for 4.3 and below? Or is that up to the plugin author to deal with that and for example ship parts of the API for older WP versions? 36. * ![](https://secure.gravatar.com/avatar/c21ff90e030a07e3a20f48a0496530828cf86ef69a464d326351423eb2570ef0? s=32&d=mm&r=g) * [Ryan McCue](https://profiles.wordpress.org/rmccue/) 7:07 am _on_ September 21, 2015 * The plan is to turn the existing pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. into one that progressively enhances your WP install. It’ll include the infrastructure for sites that don’t have it, but will use coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress.’s otherwise. Once the endpoints are merged, it’ll disable itself. 🙂 * I’d expect that we’ll aim to support this at least until the next major releasemajor release A release, identified by the first two numbers (3.6), which is the focus of a full release cycle and feature development. WordPress uses decimaling count for major release versions, so 2.8, 2.9, 3.0, and 3.1 are sequential and comparable in scope. after the endpoints are merged. - ![](https://secure.gravatar.com/avatar/67c29b1c856079e9bac1ad3b97d9077abdc21b90ac0b4fee88508363b1167b6b? s=32&d=mm&r=g) - [borekb](https://profiles.wordpress.org/borekb/) 7:11 am _on_ September 21, 2015 - Cool, thanks for the answer. - ![](https://secure.gravatar.com/avatar/5c63786d537517896dac24d0f96e71334654b273795ee416e6e7ed5afc560a3d? s=32&d=mm&r=g) - [xavivars](https://profiles.wordpress.org/xavivars/) 5:45 pm _on_ September 23, 2015 - That’s the answer I was dreaming!!! We’re working on a project right now where we’re building a site that would benefit a lot from having a powerfull rest-api like the one you guys have built, but my concern was that there was no way to fully use it until it was integrated. - Seriously, you guys are awesome 🙂 * ![](https://secure.gravatar.com/avatar/27180c82524020e7339e2b30818b6d8ab004c54f730f12b1434b1e365be0e175? s=32&d=mm&r=g) * [Ipstenu (Mika Epstein)](https://profiles.wordpress.org/ipstenu/) 1:43 pm _on_ September 21, 2015 * Keep in mind what the ‘compatible up to’ and ‘requires’ version actually means in plugins. If you say your pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. requires 4.4, then no one on 4.3 gets updates. In theory you could back port your 4.3 compat tags (say your version 2.5 is sans APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways. while 2.6 is with the new API), and just update 2.5.1 and 2.6.1 for each user base. 37. ![](https://secure.gravatar.com/avatar/1dba75a903be8eb13bae6f961d81a99e5c76d5ca8c327a18bc25e96df2417b99? s=32&d=mm&r=g) 38. [Hugh Lashbrooke](https://profiles.wordpress.org/hlashbrooke/) 8:25 am _on_ September 21, 2015 39. > This adds a simplified routing layer outside of WP’s rewrites, allowing non- query-var rewrites easily. 40. I never even thought of that as a possibility with this APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways. and I think that excites me more than anything else about this project. It couldn’t be in coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. sooner 🙂 41. ![](https://secure.gravatar.com/avatar/6e4571654d64b592ec6f6208a982d2bc2f408433cc970fab55a68f716cc2f714? s=32&d=mm&r=g) 42. [Erlend Sogge Heggen](https://profiles.wordpress.org/sadr/) 10:28 am _on_ September 21, 2015 43. First and foremost: CONGRATS! Major props to everyone involved. 44. Just one question: What about all these overlapping technologies (XML-RPC, the adminadmin (and super admin)-ajax etc.) that you mention. Is there a deprecation plan in place for the parts that the REST APIREST API The REST API is an acronym for the RESTful Application Program Interface (API) that uses HTTP requests to GET, PUT, POST and DELETE data. It is how the front end of an application (think“ phone app” or “website”) can communicate with the data store (think “database” or “file system”) [https://developer.wordpress.org/rest-api/](https://developer.wordpress.org/rest-api/) will cover? 45. * ![](https://secure.gravatar.com/avatar/c21ff90e030a07e3a20f48a0496530828cf86ef69a464d326351423eb2570ef0? s=32&d=mm&r=g) * [Ryan McCue](https://profiles.wordpress.org/rmccue/) 1:30 pm _on_ September 21, 2015 * There’s no deprecation plan for them, as they’re not complete replacements. We’ll see what happens in time though; if usage of another APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways. were to drop significantly in favour of the REST APIREST API The REST API is an acronym for the RESTful Application Program Interface (API) that uses HTTP requests to GET, PUT, POST and DELETE data. It is how the front end of an application (think “phone app” or “website”) can communicate with the data store (think “database” or “file system”) [https://developer.wordpress.org/rest-api/](https://developer.wordpress.org/rest-api/), maybe we could look at it in the future. 46. ![](https://secure.gravatar.com/avatar/d02a4e24f81bb9cba462d90227c43a6f84518694f8db18180f977640f16c99da? s=32&d=mm&r=g) 47. [James DiGioia](https://profiles.wordpress.org/jamesdigioia/) 12:11 pm _on_ September 21, 2015 48. Very exciting! One question: Will the Backbone client be merged as part of the endpoints, the infrastructure, or as a separate step entirely? 49. * ![](https://secure.gravatar.com/avatar/c21ff90e030a07e3a20f48a0496530828cf86ef69a464d326351423eb2570ef0? s=32&d=mm&r=g) * [Ryan McCue](https://profiles.wordpress.org/rmccue/) 1:30 pm _on_ September 21, 2015 * The Backbone client is linked to the endpoints, so it’d be merged with them if at all; we’ll discuss whether it should be as we get closer to merging them 🙂 50. ![](https://secure.gravatar.com/avatar/8845aff3f199163c862fab2df0749653d1becc94902764cbba85dc67bb2e6ae6? s=32&d=mm&r=g) 51. [Omaar Osmaan](https://profiles.wordpress.org/moonomo/) 12:14 pm _on_ September 21, 2015 52. 😀 53. ![](https://secure.gravatar.com/avatar/af6cb02f92815fa3d3c86aa63a507360b5130a075f13666748575e63b34edfe1? s=32&d=mm&r=g) 54. [Marcus](https://profiles.wordpress.org/netweblogic/) 12:21 pm _on_ September 21, 2015 55. I’m bummed that I haven’t had the chance yet to play with the APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways. yet and give constructive feedback, so words of encouragement is all I can offer. I’ve been following this project closely and can’t wait for this to happen 🙂 this has so much potential for WP as a whole. 56. Well done to the whole JSONJSON JSON, or JavaScript Object Notation, is a minimal, readable format for structuring data. It is used primarily to transmit data between a server and web application, as an alternative to XML. API team, thanks for all your efforts. Go for it! 57. ![](https://secure.gravatar.com/avatar/db79d5416d942e5fd9415b136feefd2da7929cc39853b4c30bafff4ceb8ef219? s=32&d=mm&r=g) 58. [Daniele Mte90 Scasciafratte](https://profiles.wordpress.org/mte90/) 12:43 pm _on_ September 21, 2015 59. I’m in this state [http://memecrunch.com/meme/3MCTZ/excited-picard/image.jpg?w=510&c=1](http://memecrunch.com/meme/3MCTZ/excited-picard/image.jpg?w=510&c=1) Also today I’ve written a little article about to expand that api the post type with custom fields [http://www.mte90.net/en/2015/09/extend-the-wordpress-rest-api-of-a-post-type-by-custom-fields/](http://www.mte90.net/en/2015/09/extend-the-wordpress-rest-api-of-a-post-type-by-custom-fields/) 60. ![](https://secure.gravatar.com/avatar/34a473773a63fb84f9a425991b98e373b4deb93b82945a1656631b1505c6955d? s=32&d=mm&r=g) 61. [Per Soderlind](https://profiles.wordpress.org/pers/) 4:42 pm _on_ September 21, 2015 62. +1 🙂 63. ![](https://secure.gravatar.com/avatar/ce9aafe20297b5e9b5b4f29ecb79a9954de779b5987d78dadc12bc1ffe5153df? s=32&d=mm&r=g) 64. [mojaray2k](https://profiles.wordpress.org/mojaray2k/) 5:20 pm _on_ September 21, 2015 65. I am so thrilled that this is happening. As a developer I am curious on how OAuth is going to be implimented. Right now it is very difficult to implement without some third party service. Or maybe I am not understanding how to implement it the WordPress way. 66. ![](https://secure.gravatar.com/avatar/323cf209e19dd825678e9ccc51bc3f745f96571f1c68af26ae7955c1fa9ad1f2? s=32&d=mm&r=g) 67. [Aaron Jorbin](https://profiles.wordpress.org/jorbin/) 5:32 pm _on_ September 21, 2015 68. Thanks for putting this together. A couple of questions that I have: 69. 1) What would happen to v1 of the APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways. upon merge? Would a new version of it be released that relied upon the routing in coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress.? Would it continue to function by itself? Would it break? 70. 2) Based on your statement ” On the other hand, all other contribution to WordPress is done via SVNSVN Subversion, the popular version control system (VCS) by the Apache project, used by WordPress to manage changes to its codebase.” are you aware that there are [git mirrors](https://make.wordpress.org/core/2014/01/15/git-mirrors-for-wordpress/) that all non-committers can use? 😀 71. 3) Is two weeks sufficient amount of time for 🎉? 72. 4) Has there been any discussion about marking any of the new classes or methods in the classes as final upon introduction? 73. * ![](https://secure.gravatar.com/avatar/c21ff90e030a07e3a20f48a0496530828cf86ef69a464d326351423eb2570ef0? s=32&d=mm&r=g) * [Ryan McCue](https://profiles.wordpress.org/rmccue/) 11:13 pm _on_ September 21, 2015 * > What would happen to v1 of the APIAPI An API or Application Programming > Interface is a software intermediary that allows programs to interact with > each other and share data in limited, clearly defined ways. upon merge? * Our original plan was to have v1 become a shell that wraps the infrastructure in coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. to provide compatibility, and I suspect we’ll still do this. We’re yet to get the specifics of it down. 🙂 * > are you aware that there are git mirrors that all non-committers can use? * Using git vs managing contributions via GitHubGitHub GitHub is a website that offers online implementation of git repositories that can easily be shared, copied and modified by other developers. Public repositories are free to host, private repositories require a paid subscription. GitHub introduced the concept of the ‘pull request’ where code changes done in branches by contributors can be reviewed and discussed before being merged by the repository owner. [https://github.com/](https://github.com/) is a different kettle of fish. Right now, I already use git for making patches, but the flow for contributing those changes back is a bit cumbersome. We can do better 🙂 * > Is two weeks sufficient amount of time for 🎉? * Maybe not, but real life commitments get in the way of any prolonged 🎉ing. 😬 * > Has there been any discussion about marking any of the new classes or methods > in the classes as final upon introduction? * Our intention is to keep them all extensibleExtensible This is the ability to add additional functionality to the code. Plugins extend the WordPress core software. for now, and they’re all designed for reuse. As for forwards- compatibility though, we’ll consider this as we “finalise” (😏) the classes for merging. 74. ![](https://secure.gravatar.com/avatar/081bd29a9e21fba20fc8131fbf65a1ed3a754d11e8b49f6e810a09fdb5d61503? s=32&d=mm&r=g) 75. [karlazz](https://profiles.wordpress.org/karlazz/) 8:17 pm _on_ September 21, 2015 76. Hello, 77. I used the APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways. briefly and then rejected it for a few reasons: 1) the Oauth1 is hard to use and not well supported with examples or libraries, why not use Oauth2 like everyone else? 2) It was awkward to get at post metaMeta Meta is a term that refers to the inside workings of a group. For us, this is the team that works on internal WordPress sites like WordCamp Central and Make WordPress. information. I used a pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party.. 3) the requests returned too much information and my programs died with a memory fault. Due to the nature of my plans for the application, this was not acceptable so I wrote simpler more specific tools that did not return mountains of unnecessary fields and require my users to increase their PHPPHP The web scripting language in which WordPress is primarily architected. WordPress requires PHP 7.4 or higher memory limit. 78. 1) There is a lack of community code available for using Oauth1, and the API authors didn’t provide any guidance for setting it up, just some information thrown over the shoulder as it were. Even the endpoints were hard to find in their literature, and not quite the same as the ones described as “standard”. I hope that will be improved, or that you will switch to Oauth2, like the rest of the world. Security is a very important aspect of this project and people need to be able to use the locks. It would be great to provide a description of how to set up and use curl calls to access the API security. Salesforce does a good job of this, as does Box.com. 79. 2) Couldn’t access postmeta information via the API unless Oauth1 is implemented. Why? Used work around. 80. 3) It would be great if I could designate which fields I need to have returned using POST data and jsonJSON JSON, or JavaScript Object Notation, is a minimal, readable format for structuring data. It is used primarily to transmit data between a server and web application, as an alternative to XML.. Box.com does this, as do others. This would save on memory when returning large numbers of records. Maybe you have this already and I missed it? 81. Thanks. Good luck. This is a great idea but I chose not to use it and would not recommend it for the above reasons. 82. * ![](https://secure.gravatar.com/avatar/c21ff90e030a07e3a20f48a0496530828cf86ef69a464d326351423eb2570ef0? s=32&d=mm&r=g) * [Ryan McCue](https://profiles.wordpress.org/rmccue/) 11:19 pm _on_ September 21, 2015 * > the Oauth1 is hard to use and not well supported with examples or libraries, > why not use Oauth2 like everyone else? * I totally agree, OAuth 1 is a pain. However, the reason that OAuth 2 is much nicer is that it relies on SSLSSL Secure Sockets Layer. Provides a secure means of sending data over the internet. Used for authenticated and private actions. to handle much of the message authentication. We can’t require SSL for WordPress coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. code, so OAuth 2 is unfortunately a non-starter there. * The OAuth Working Group has been making slow progress towards removing this requirement, and we’ve been following that. If anything changes there, we’ll consider changing it. * > Couldn’t access postmeta information via the APIAPI An API or Application > Programming Interface is a software intermediary that allows programs to > interact with each other and share data in limited, clearly defined ways. > unless Oauth1 is implemented. Why? Used work around. * Working with postmeta requires a great deal of care, due to privacy and security concerns. As it turns out, there are lots of people who use the Custom Fields box to save private notes directly to post metaMeta Meta is a term that refers to the inside workings of a group. For us, this is the team that works on internal WordPress sites like WordCamp Central and Make WordPress., so we cannot just expose all meta without considering. * We’re looking at relaxing the restrictions here in the future: [https://github.com/WP-API/WP-API/issues/1425](https://github.com/WP-API/WP-API/issues/1425) * > It would be great if I could designate which fields I need to have returned > using POST data and jsonJSON JSON, or JavaScript Object Notation, is a minimal, > readable format for structuring data. It is used primarily to transmit data > between a server and web application, as an alternative to XML.. * This is something that most people don’t need, and which also has the ability to play havoc with server-side caches. This is easily doable in a pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. however, and we’d love to see someone take up the work there. * See [https://github.com/WP-API/WP-API/issues/572](https://github.com/WP-API/WP-API/issues/572) for more details. - ![](https://secure.gravatar.com/avatar/693ed59f42ef191f0d3e33cec6de877480eab64b4e93727b13e5f412d9553280? s=32&d=mm&r=g) - [pathartl](https://profiles.wordpress.org/pathartl/) 3:52 pm _on_ September 24, 2015 - Just showing my support for keeping post metaMeta Meta is a term that refers to the inside workings of a group. For us, this is the team that works on internal WordPress sites like WordCamp Central and Make WordPress. behind Oauth. At first I was skeptical, but it’s very easy to hook into the data via the `json_prepare_post` filterFilter Filters are one of the two types of Hooks [https://codex.wordpress.org/Plugin_API/Hooks](https://codex.wordpress.org/Plugin_API/Hooks). They provide a way for functions to modify data of other functions. They are the counterpart to Actions. Unlike Actions, filters are meant to work in an isolated manner, and should never have side effects such as affecting global variables and output. and add any data you want to the JSONJSON JSON, or JavaScript Object Notation, is a minimal, readable format for structuring data. It is used primarily to transmit data between a server and web application, as an alternative to XML. response. 83. ![](https://secure.gravatar.com/avatar/c781cc484ce017616a05c9d50c812a30c745d93eb2ea96eaa2c243d1836984db? s=32&d=mm&r=g) 84. [John Teague](https://profiles.wordpress.org/john-teague/) 8:26 pm _on_ September 21, 2015 85. I can’t tell you how happy I am and how thankful I am to the entire REST APIREST API The REST API is an acronym for the RESTful Application Program Interface ( API) that uses HTTP requests to GET, PUT, POST and DELETE data. It is how the front end of an application (think “phone app” or “website”) can communicate with the data store (think “database” or “file system”) [https://developer.wordpress.org/rest-api/](https://developer.wordpress.org/rest-api/) team. I have lobbied for the inclusion into coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress., and I know this will make WP stronger and better for the future. Kudos all around [@ryan](https://profiles.wordpress.org/ryan/), [@rachelbaker](https://profiles.wordpress.org/rachelbaker/), contributors all. 🙌 86. ![](https://secure.gravatar.com/avatar/c0113b43c8dd56a18f20323ef51486b72927d0785a23d6d9f87d06d1c4e85bcd? s=32&d=mm&r=g) 87. [Greg Ichneumon Brown](https://profiles.wordpress.org/gibrown/) 9:53 pm _on_ September 21, 2015 88. The v2 docs mention 3 types of authentication: cookie auth, oath1, and basic auth. You mention though that Authentication is a separate project. 89. Are some of these (all?) going to be part of the merge and when are they available( stage 2?). I assume many of the endpoints are not useful without some level of authentication (though I guess there are many GET endpoints that could work without auth). 90. * ![](https://secure.gravatar.com/avatar/c21ff90e030a07e3a20f48a0496530828cf86ef69a464d326351423eb2570ef0? s=32&d=mm&r=g) * [Ryan McCue](https://profiles.wordpress.org/rmccue/) 11:20 pm _on_ September 21, 2015 * Cookie authentication is built-in to WordPress, so that’ll be there out of the box. Basic authentication is only intended as a development tool, so the intention is to never include this with WordPress. OAuth 1 is something we’ll consider in the future, either when merging the endpoints, or shortly afterwards. 91. ![](https://secure.gravatar.com/avatar/54ea865129e8b20d03cc2e521e004c79362c79e36d6e9ea7866b1b6d918840ad? s=32&d=mm&r=g) 92. [Michael Beil](https://profiles.wordpress.org/michaelbeil/) 10:18 pm _on_ September 21, 2015 93. This is such momentous news [@ryan](https://profiles.wordpress.org/ryan/) and [@rachelbaker](https://profiles.wordpress.org/rachelbaker/)! 94. ![](https://secure.gravatar.com/avatar/d695f302425899d7a23cf435fdbf36aaa873c9cb5f049e3ce5f231e8d6f4bc71? s=32&d=mm&r=g) 95. [simonrcodrington](https://profiles.wordpress.org/simonrcodrington/) 12:27 am _on_ September 22, 2015 96. I’m all for the integration of the REST APIREST API The REST API is an acronym for the RESTful Application Program Interface (API) that uses HTTP requests to GET, PUT, POST and DELETE data. It is how the front end of an application (think“ phone app” or “website”) can communicate with the data store (think “database” or “file system”) [https://developer.wordpress.org/rest-api/](https://developer.wordpress.org/rest-api/) into WordPress coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress.. My concern is if this will produce any strange side effects that could affect my sites (I know this supports multiple types of security such as oAuth but it’s always on my mind) 97. It’s been tested for a while but I still think a cautious approach to this would be better (with starting integration later at WP 4.5 and then moving from there). It’s one of the biggest introductions to core in a while so I’m happy with a slower pace 🙂 98. * ![](https://secure.gravatar.com/avatar/c21ff90e030a07e3a20f48a0496530828cf86ef69a464d326351423eb2570ef0? s=32&d=mm&r=g) * [Ryan McCue](https://profiles.wordpress.org/rmccue/) 12:58 am _on_ September 23, 2015 * With this first phase, there won’t be any read or write capabilitiescapability A **capability** is permission to perform one or more types of task. Checking if a user has a capability is performed by the `current_user_can` function. Each user of a WordPress site might have some permissions but not others, depending on their role. For example, users who have the Author role usually have permission to edit their own posts (the “edit_posts” capability), but not permission to edit other users’ posts (the “edit_others_posts” capability). added, only internal APIs. A future version will start integrating those as part of the second phase. * We’ve also been working on this for ~2 years, and in the meantime we’ve fixed a few security bugs (mostly minor), so we’ve already had lots of eyes over the code. 🙂 99. ![](https://secure.gravatar.com/avatar/280bd46db13f55c4fb8e7d153760f096e1eb3811c2cb5525698b94229852ed62? s=32&d=mm&r=g) 100. [Zach Russell](https://profiles.wordpress.org/protechig/) 6:01 pm _on_ September 22, 2015 101. I scanned through the comments and don’t think I found an answer there. I’m working on an app right now that uses the WP APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways.. Will I have to make any changes to my code once the WP API is merged with coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress.? 102. * ![](https://secure.gravatar.com/avatar/c21ff90e030a07e3a20f48a0496530828cf86ef69a464d326351423eb2570ef0? s=32&d=mm&r=g) * [Ryan McCue](https://profiles.wordpress.org/rmccue/) 1:47 am _on_ September 23, 2015 * The plan is that the current v2 will become the coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. version with minimal changes. If you build off v2 now, you may need to change your code slightly, but changes will almost certainly be minor. 103. ![](https://secure.gravatar.com/avatar/8e440e9db8f9c3a0b178ffc65d057ebafa3f90bb32763c8c06130fd50f96b107? s=32&d=mm&r=g) 104. [Praveen Chauhan](https://profiles.wordpress.org/praveen-chauhan/) 9:38 am _on_ September 23, 2015 105. Great news !!! Congrats to the REST APIREST API The REST API is an acronym for the RESTful Application Program Interface (API) that uses HTTP requests to GET, PUT, POST and DELETE data. It is how the front end of an application (think “ phone app” or “website”) can communicate with the data store (think “database” or “file system”) [https://developer.wordpress.org/rest-api/](https://developer.wordpress.org/rest-api/) team. 106. Have few questions: 107. 1) How will REST API specific support queries/updates be handled? For a pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress. org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party., there can be many support queries, and there is a dedicated forum. So if some one has queries specifically related to the REST API, will you continue to use the REST API plugin’s forum or have you planned to shutdown that forum or plugin listing? More importantly, how will updates for the fixes be handled? I mean, if some one has issues specific to the REST API functionality which requires some fixes, will the users need to wait for the new release of WordPress or do you have an alternative plan for this? 108. 2) What will be the impact on WordPress’ performance? As a plugin, the functionality is optional for users. But after merging it into the coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress., its modules will be loaded along with WordPress. So what would be its impact on site load, performance etc? 109. * ![](https://secure.gravatar.com/avatar/e7834f9621ee7d5f9e5df09568e00cc70d7f71d80cc5a13f7742210b72e1385a? s=32&d=mm&r=g) * [Shapeshifter 3](https://profiles.wordpress.org/shapeshifter-3/) 4:28 pm _on_ September 23, 2015 * 2) Is a really good question…I’d like to know the answer also. 110. ![](https://secure.gravatar.com/avatar/693ed59f42ef191f0d3e33cec6de877480eab64b4e93727b13e5f412d9553280? s=32&d=mm&r=g) 111. [pathartl](https://profiles.wordpress.org/pathartl/) 4:12 pm _on_ September 24, 2015 112. +1 in full support. A question and comment: 113. 1. What will happen with the pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. (both v1 and v2) when it is activated on an install that has the APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways. in coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress.? We’ve written some read-only things for v1 and I’m concerned about having a major refactor later on down the road. No doubt it will eventually happen, but the concern lies in the first couple phases of integration. 114. I’m glad the core committers will have to look at every aspect. I found the documentation lacking in places. Well not necessarily lacking, but not as well documented as most things in the codex. This is a big merge that is totally developer focused and should be hashed out really well. 115. Thanks for the hard work! This is much needed 116. ![](https://secure.gravatar.com/avatar/ab5f48e06c24b05f933018d858237aa6d3811cd82c256e7063011d967c25e082? s=32&d=mm&r=g) 117. [suifengtec](https://profiles.wordpress.org/suifengtec/) 5:08 pm _on_ October 9, 2015 118. It’s cool for the future of WordPress ! 119. ![](https://secure.gravatar.com/avatar/96ceca2c134d66668982e5bf68ba4ad71fd54eff5d7b3cb4ae3e67915b42bec0? s=32&d=mm&r=g) 120. [snstarosciak](https://profiles.wordpress.org/snstarosciak/) 1:21 pm _on_ October 21, 2015 121. Nice! So here’s my question. How will this impact current sites using the WP APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways. v2? Assuming building something like this into coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. will make API-creation plugins unecessary, I’m guessing that the “ final” functionality will be available in 4.5 that is similar to how the WP API v2 works? 122. Thankyou! 123. ![](https://secure.gravatar.com/avatar/bd88f2bc29d6fcd512bd50fd3cf9d3fa7cd188f8467ce48b75964b0964f08037? s=32&d=mm&r=g) 124. [mmaumio](https://profiles.wordpress.org/mmaumio/) 9:01 pm _on_ November 5, 2015 125. That’s Awesome. It’ll surely save us from creating our APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways. or using a third party pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party.. +1 for this. 126. ![](https://secure.gravatar.com/avatar/0a3c3fb2166e958baba47310abe979083712da3b219a1a948f3e5d8e8ac2a88b? s=32&d=mm&r=g) 127. [WP Plugin Dev dot com](https://profiles.wordpress.org/theode/) 12:41 pm _on_ November 20, 2015 128. Two important questions arise: What is public in the APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways. after the merge? Can I tell WordPress to don’t provide the API functionallity? Comments are closed. # Post navigation [← my-hacks.php no longer supported](https://make.wordpress.org/core/2015/09/18/my-hacks-php-no-longer-supported/) [Week in Core: Sept. 13-21, 2015 →](https://make.wordpress.org/core/2015/09/21/week-in-core-sept-13-21-2015/)