WordPress REST API开发：自定义端点与认证配置

本文介绍如何开发WordPress REST API自定义端点，实现安全的API认证配置和外部应用集成。

WordPress REST API允许外部应用与WordPress交互，是构建无头CMS和移动应用的基础。

端点	方法	用途
/wp/v2/posts	GET/POST	文章操作
/wp/v2/users	GET	用户列表
/wp/v2/categories	GET	分类列表

add_action('rest_api_init', function () {
    register_rest_route('myapi/v1', '/articles', [
        'methods'  => 'GET',
        'callback' => 'my_get_articles',
        'permission_callback' => '__return_true',
    ]);
});

function my_get_articles($request) {
    $args = [
        'post_type' => 'post',
        'posts_per_page' => $request->get_param('limit') ?: 10,
    ];
    $posts = get_posts($args);

    $data = [];
    foreach ($posts as $post) {
        $data[] = [
            'id'      => $post->ID,
            'title'   => $post->post_title,
            'excerpt' => $post->post_excerpt,
            'link'    => get_permalink($post->ID),
        ];
    }
    return $data;
}

register_rest_route('myapi/v1', '/article/(?P<id>\d+)', [
    'methods'  => 'GET',
    'callback' => 'get_single_article',
    'args' => [
        'id' => ['validate_callback' => 'is_numeric'],
    ],
]);

// 请求头格式
// Authorization: Basic base64(username:app_password)

// PHP请求示例
$response = wp_remote_get($api_url, [
    'headers' => [
        'Authorization' => 'Basic ' . base64_encode('admin:xxxx xxxx xxxx xxxx'),
    ]
]);

安装JWT Authentication插件后：

// 获取Token
$token = wp_remote_post('/wp-json/jwt-auth/v1/token', [
    'body' => ['username' => 'admin', 'password' => 'pass']
]);

// 使用Token
$response = wp_remote_get($api_url, [
    'headers' => [
        'Authorization' => 'Bearer ' . $token,
    ]
]);

register_rest_route('myapi/v1', '/admin/data', [
    'methods'  => 'POST',
    'callback' => 'admin_endpoint',
    'permission_callback' => function () {
        return current_user_can('manage_options');
    }
]);

措施	说明
HTTPS强制	所有API请求走HTTPS
输入验证	使用get_param配合sanitize
速率限制	防止API滥用
权限检查	敏感操作验证权限
CORS配置	控制跨域访问

// WordPress主题functions.php
add_action('rest_api_init', function () {
    // 获取置顶文章
    register_rest_route('myapi/v1', '/featured', [
        'methods' => 'GET',
        'callback' => function() {
            $posts = get_posts(['post__in' => get_option('sticky_posts')]);
            return array_map(function($p) {
                return [
                    'id'    => $p->ID,
                    'title' => $p->post_title,
                    'image' => get_the_post_thumbnail_url($p->ID, 'medium'),
                ];
            }, $posts);
        },
        'permission_callback' => '__return_true',
    ]);
});

WordPress REST API让CMS不再是简单的博客系统，而是强大的内容管理平台。