WordPress REST API: Complete Guide for Developers and AI Agents (2026)

👁 36 views

What Is the WordPress REST API?

The WordPress REST API is a built-in interface that lets external applications read and write WordPress data using standard HTTP requests. Posts, pages, users, categories, custom post types — all of it is accessible via structured JSON endpoints, no browser required.

It ships with every WordPress installation since version 4.7. You don’t install it. You don’t configure it. It’s already there, waiting to be used.

The base URL pattern is simple:

https://yoursite.com/wp-json/wp/v2/

Every WordPress site you run has this endpoint active by default.

Why the WordPress REST API Matters for AI Agents

For years, the REST API was primarily a developer tool — used to build headless WordPress sites, mobile apps, and third-party integrations. That’s still true. But something changed in 2025.

AI agents need structured interfaces. They can’t navigate a WordPress dashboard the way a human does. They need machine-readable endpoints with predictable inputs and outputs. The WordPress REST API is exactly that.

When we built Master Control Press, the REST API was the foundation. Our MCP Adapter sits on top of it, translating natural language instructions into REST API calls. When you tell Claude “publish this post as a draft,” the agent is making a POST request to /wp-json/wp/v2/posts with your content as the payload.

The REST API didn’t need to be redesigned for AI. It was already the right interface — it just needed a translation layer.

Core WordPress REST API Endpoints

Here are the endpoints you’ll use most often:

Posts

• GET /wp-json/wp/v2/posts — list posts
• POST /wp-json/wp/v2/posts — create a post
• GET /wp-json/wp/v2/posts/{id} — get a specific post
• PUT /wp-json/wp/v2/posts/{id} — update a post
• DELETE /wp-json/wp/v2/posts/{id} — delete (trash) a post

Pages

• GET /wp-json/wp/v2/pages — list pages
• POST /wp-json/wp/v2/pages — create a page
• PUT /wp-json/wp/v2/pages/{id} — update a page

Media

• GET /wp-json/wp/v2/media — list media
• POST /wp-json/wp/v2/media — upload a file

Users, Categories, Tags

• GET /wp-json/wp/v2/users
• GET /wp-json/wp/v2/categories
• GET /wp-json/wp/v2/tags

WordPress REST API Authentication

Read-only requests to public content require no authentication. But any write operation — creating posts, updating content, deleting media — requires auth.

There are three practical options:

1. Application Passwords (Built-in, recommended)

WordPress 5.6 introduced Application Passwords natively. Go to Users → Profile → Application Passwords, generate a password for your integration, and use HTTP Basic Auth:

Authorization: Basic base64(username:application_password)

This is what the MCP Adapter uses under the hood. It’s simple, revocable per-application, and doesn’t expose your main account password.

2. JWT Authentication

The JWT Authentication plugin adds token-based auth. Better for stateless integrations where you need short-lived tokens.

3. OAuth 1.0a

The original WordPress REST API authentication method. More complex to implement, less common now that Application Passwords ship natively.

How to Enable the WordPress REST API

The API is enabled by default. On most WordPress sites, you can confirm it’s working by visiting:

https://yoursite.com/wp-json/

You’ll see a JSON response listing available routes and namespaces.

If the REST API isn’t responding, common causes include:

• A security plugin blocking REST API requests (check Wordfence, iThemes Security settings)
• A .htaccess rule blocking /wp-json/ requests
• The REST API disabled via a filter in functions.php

To check if it’s been disabled via code, search your theme and plugins for:

rest_authentication_errors
rest_enabled

Extending the REST API with Custom Post Types

Custom post types don’t automatically appear in the REST API unless you register them with show_in_rest set to true:

register_post_type( 'product', array(
    'show_in_rest' => true,
    'rest_base'    => 'products',
    // ... other args
) );

The same applies to custom fields registered with ACF — you need to enable REST API support in the field group settings to expose field data via the API.

This matters for AI agents. If your custom post types and fields aren’t exposed, the agent can’t read or write them. The MCP Adapter handles this automatically for registered types, but it can only work with what WordPress exposes.

WordPress REST API and the MCP Connection

The Model Context Protocol (MCP) was designed for exactly this kind of integration. It gives AI models a standardized way to call external tools and APIs.

Here’s what happens when you use Master Control Press to manage your site:

1. You send a natural language instruction to Claude
2. Claude identifies the right MCP tool to use (e.g., wordpress-mcp-create-post)
3. The MCP Adapter translates that into a WordPress REST API call
4. WordPress executes the operation and returns a response
5. Claude confirms the result in plain language

The REST API is the bridge. Without it, there’s no programmatic access. With it, your entire WordPress site becomes something an AI agent can operate — creating content, managing media, updating settings, bulk-editing posts — all through conversation.

Common WordPress REST API Use Cases

Headless WordPress

Use WordPress as a CMS backend while serving the frontend with Next.js, Nuxt, Astro, or any framework. The REST API (or GraphQL via WPGraphQL) delivers the content.

Mobile Apps

Build iOS/Android apps powered by WordPress content without coupling to the WordPress theme layer.

AI Agent Automation

The newest use case — and the one growing fastest. AI agents managing WordPress sites, creating content pipelines, handling bulk operations across multiple sites, and integrating with external data sources.

Third-Party Integrations

Connect WordPress to CRMs, email platforms, analytics tools, or any external system that can make HTTP requests.

WordPress REST API vs WPGraphQL

GraphQL is an alternative query language that lets clients request exactly the fields they need. WPGraphQL is the most popular WordPress implementation.

For AI agents, the REST API has a practical advantage: it’s built-in, requires no additional plugins, and every WordPress installation has it. GraphQL offers more flexibility for complex queries, but adds a dependency.

We built MCP Adapter on REST for that reason — it works on any WordPress site out of the box.

Getting Started

If you want to explore your site’s REST API:

1. Visit https://yoursite.com/wp-json/wp/v2/posts?per_page=5 — you’ll see your last 5 published posts as JSON
2. Install Postman or Insomnia for testing authenticated requests
3. Generate an Application Password in your user profile
4. Try a GET /wp-json/wp/v2/users/me with your credentials to confirm auth is working

If you want to skip the manual setup and let an AI agent work with your WordPress site directly, that’s what Master Control Press is built for.