$path = '/' . ltrim( $path, '/' );
if ( is_multisite() && get_blog_option( $blog_id, 'permalink_structure' ) || get_option( 'permalink_structure' ) ) {
if ( $wp_rewrite->using_index_permalinks() ) {
$url = get_home_url( $blog_id, $wp_rewrite->index . '/' . rest_get_url_prefix(), $scheme );
$url = get_home_url( $blog_id, rest_get_url_prefix(), $scheme );
$url = trailingslashit( get_home_url( $blog_id, '', $scheme ) );
* nginx only allows HTTP/1.0 methods when redirecting from / to /index.php.
* To work around this, we manually add index.php to the URL, avoiding the redirect.
if ( ! str_ends_with( $url, 'index.php' ) ) {
$url = add_query_arg( 'rest_route', $path, $url );
if ( is_ssl() && isset( $_SERVER['SERVER_NAME'] ) ) {
// If the current host is the same as the REST URL host, force the REST URL scheme to HTTPS.
if ( parse_url( get_home_url( $blog_id ), PHP_URL_HOST ) === $_SERVER['SERVER_NAME'] ) {
$url = set_url_scheme( $url, 'https' );
if ( is_admin() && force_ssl_admin() ) {
* In this situation the home URL may be http:, and `is_ssl()` may be false,
* but the admin is served over https: (one way or another), so REST API usage
* will be blocked by browsers unless it is also served over HTTPS.
$url = set_url_scheme( $url, 'https' );
* Use this filter to adjust the url returned by the get_rest_url() function.
* @param string $url REST URL.
* @param string $path REST route.
* @param int|null $blog_id Blog ID.
* @param string $scheme Sanitization scheme.
return apply_filters( 'rest_url', $url, $path, $blog_id, $scheme );
* Retrieves the URL to a REST endpoint.
* Note: The returned URL is NOT escaped.
* @param string $path Optional. REST route. Default empty.
* @param string $scheme Optional. Sanitization scheme. Default 'rest'.
* @return string Full URL to the endpoint.
function rest_url( $path = '', $scheme = 'rest' ) {
return get_rest_url( null, $path, $scheme );
* Used primarily to route internal requests through WP_REST_Server.
* @param WP_REST_Request|string $request Request.
* @return WP_REST_Response REST response.
function rest_do_request( $request ) {
$request = rest_ensure_request( $request );
return rest_get_server()->dispatch( $request );
* Retrieves the current REST server instance.
* Instantiates a new instance if none exists already.
* @global WP_REST_Server $wp_rest_server REST server instance.
* @return WP_REST_Server REST server instance.
function rest_get_server() {
/* @var WP_REST_Server $wp_rest_server */
if ( empty( $wp_rest_server ) ) {
* Filters the REST Server Class.
* This filter allows you to adjust the server class used by the REST API, using a
* different class to handle requests.
* @param string $class_name The name of the server class. Default 'WP_REST_Server'.
$wp_rest_server_class = apply_filters( 'wp_rest_server_class', 'WP_REST_Server' );
$wp_rest_server = new $wp_rest_server_class();
* Fires when preparing to serve a REST API request.
* Endpoint objects should be created and register their hooks on this action rather
* than another action to ensure they're only loaded when needed.
* @param WP_REST_Server $wp_rest_server Server object.
do_action( 'rest_api_init', $wp_rest_server );
* Ensures request arguments are a request object (for consistency).
* @since 5.3.0 Accept string argument for the request path.
* @param array|string|WP_REST_Request $request Request to check.
* @return WP_REST_Request REST request instance.
function rest_ensure_request( $request ) {
if ( $request instanceof WP_REST_Request ) {
if ( is_string( $request ) ) {
return new WP_REST_Request( 'GET', $request );
return new WP_REST_Request( 'GET', '', $request );
* Ensures a REST response is a response object (for consistency).
* This implements WP_REST_Response, allowing usage of `set_status`/`header`/etc
* without needing to double-check the object. Will also allow WP_Error to indicate error
* responses, so users should immediately check for this value.
* @param WP_REST_Response|WP_Error|WP_HTTP_Response|mixed $response Response to check.
* @return WP_REST_Response|WP_Error If response generated an error, WP_Error, if response
* is already an instance, WP_REST_Response, otherwise
* returns a new WP_REST_Response instance.
function rest_ensure_response( $response ) {
if ( is_wp_error( $response ) ) {
if ( $response instanceof WP_REST_Response ) {
* While WP_HTTP_Response is the base class of WP_REST_Response, it doesn't provide
* all the required methods used in WP_REST_Server::dispatch().
if ( $response instanceof WP_HTTP_Response ) {
return new WP_REST_Response(
return new WP_REST_Response( $response );
* Handles _deprecated_function() errors.
* @param string $function_name The function that was called.
* @param string $replacement The function that should have been called.
* @param string $version Version.
function rest_handle_deprecated_function( $function_name, $replacement, $version ) {
if ( ! WP_DEBUG || headers_sent() ) {
if ( ! empty( $replacement ) ) {
/* translators: 1: Function name, 2: WordPress version number, 3: New function name. */
$string = sprintf( __( '%1$s (since %2$s; use %3$s instead)' ), $function_name, $version, $replacement );
/* translators: 1: Function name, 2: WordPress version number. */
$string = sprintf( __( '%1$s (since %2$s; no alternative available)' ), $function_name, $version );
header( sprintf( 'X-WP-DeprecatedFunction: %s', $string ) );
* Handles _deprecated_argument() errors.
* @param string $function_name The function that was called.
* @param string $message A message regarding the change.
* @param string $version Version.
function rest_handle_deprecated_argument( $function_name, $message, $version ) {
if ( ! WP_DEBUG || headers_sent() ) {
/* translators: 1: Function name, 2: WordPress version number, 3: Error message. */
$string = sprintf( __( '%1$s (since %2$s; %3$s)' ), $function_name, $version, $message );
/* translators: 1: Function name, 2: WordPress version number. */
$string = sprintf( __( '%1$s (since %2$s; no alternative available)' ), $function_name, $version );
header( sprintf( 'X-WP-DeprecatedParam: %s', $string ) );
* Handles _doing_it_wrong errors.
* @param string $function_name The function that was called.
* @param string $message A message explaining what has been done incorrectly.
* @param string|null $version The version of WordPress where the message was added.
function rest_handle_doing_it_wrong( $function_name, $message, $version ) {
if ( ! WP_DEBUG || headers_sent() ) {
/* translators: Developer debugging message. 1: PHP function name, 2: WordPress version number, 3: Explanatory message. */
$string = __( '%1$s (since %2$s; %3$s)' );
$string = sprintf( $string, $function_name, $version, $message );
/* translators: Developer debugging message. 1: PHP function name, 2: Explanatory message. */
$string = __( '%1$s (%2$s)' );
$string = sprintf( $string, $function_name, $message );
header( sprintf( 'X-WP-DoingItWrong: %s', $string ) );
* Sends Cross-Origin Resource Sharing headers with API requests.
* @param mixed $value Response data.
* @return mixed Response data.
function rest_send_cors_headers( $value ) {
$origin = get_http_origin();
// Requests from file:// and data: URLs send "Origin: null".
if ( 'null' !== $origin ) {
$origin = sanitize_url( $origin );
header( 'Access-Control-Allow-Origin: ' . $origin );
header( 'Access-Control-Allow-Methods: OPTIONS, GET, POST, PUT, PATCH, DELETE' );
header( 'Access-Control-Allow-Credentials: true' );
header( 'Vary: Origin', false );
} elseif ( ! headers_sent() && 'GET' === $_SERVER['REQUEST_METHOD'] && ! is_user_logged_in() ) {
header( 'Vary: Origin', false );
* Handles OPTIONS requests for the server.
* This is handled outside of the server code, as it doesn't obey normal route
* @param mixed $response Current response, either response or `null` to indicate pass-through.
* @param WP_REST_Server $handler ResponseHandler instance (usually WP_REST_Server).
* @param WP_REST_Request $request The request that was used to make current response.
* @return WP_REST_Response Modified response, either response or `null` to indicate pass-through.
function rest_handle_options_request( $response, $handler, $request ) {
if ( ! empty( $response ) || $request->get_method() !== 'OPTIONS' ) {
$response = new WP_REST_Response();
foreach ( $handler->get_routes() as $route => $endpoints ) {
$match = preg_match( '@^' . $route . '$@i', $request->get_route(), $matches );
foreach ( $matches as $param => $value ) {
if ( ! is_int( $param ) ) {
$args[ $param ] = $value;
foreach ( $endpoints as $endpoint ) {
$request->set_url_params( $args );
$request->set_attributes( $endpoint );
$data = $handler->get_data_for_route( $route, $endpoints, 'help' );
$response->set_matched_route( $route );
$response->set_data( $data );
* Sends the "Allow" header to state all methods that can be sent to the current route.
* @param WP_REST_Response $response Current response being served.
* @param WP_REST_Server $server ResponseHandler instance (usually WP_REST_Server).
* @param WP_REST_Request $request The request that was used to make current response.
* @return WP_REST_Response Response to be served, with "Allow" header if route has allowed methods.
function rest_send_allow_header( $response, $server, $request ) {
$matched_route = $response->get_matched_route();
if ( ! $matched_route ) {
$routes = $server->get_routes();
$allowed_methods = array();
// Get the allowed methods across the routes.
foreach ( $routes[ $matched_route ] as $_handler ) {
foreach ( $_handler['methods'] as $handler_method => $value ) {
if ( ! empty( $_handler['permission_callback'] ) ) {
$permission = call_user_func( $_handler['permission_callback'], $request );
$allowed_methods[ $handler_method ] = true === $permission;
$allowed_methods[ $handler_method ] = true;
// Strip out all the methods that are not allowed (false values).
$allowed_methods = array_filter( $allowed_methods );
if ( $allowed_methods ) {
$response->header( 'Allow', implode( ', ', array_map( 'strtoupper', array_keys( $allowed_methods ) ) ) );
* Recursively computes the intersection of arrays using keys for comparison.
* @param array $array1 The array with master keys to check.
* @param array $array2 An array to compare keys against.
* @return array An associative array containing all the entries of array1 which have keys
* that are present in all arguments.
function _rest_array_intersect_key_recursive( $array1, $array2 ) {
$array1 = array_intersect_key( $array1, $array2 );
foreach ( $array1 as $key => $value ) {
if ( is_array( $value ) && is_array( $array2[ $key ] ) ) {
$array1[ $key ] = _rest_array_intersect_key_recursive( $value, $array2[ $key ] );
* Filters the REST API response to include only an allow-listed set of response object fields.
* @param WP_REST_Response $response Current response being served.
* @param WP_REST_Server $server ResponseHandler instance (usually WP_REST_Server).
* @param WP_REST_Request $request The request that was used to make current response.
* @return WP_REST_Response Response to be served, trimmed down to contain a subset of fields.
function rest_filter_response_fields( $response, $server, $request ) {
if ( ! isset( $request['_fields'] ) || $response->is_error() ) {
$data = $response->get_data();
$fields = wp_parse_list( $request['_fields'] );
if ( 0 === count( $fields ) ) {
// Trim off outside whitespace from the comma delimited list.
$fields = array_map( 'trim', $fields );
// Create nested array of accepted field hierarchy.
$fields_as_keyed = array();
foreach ( $fields as $field ) {
$parts = explode( '.', $field );
$ref = &$fields_as_keyed;
while ( count( $parts ) > 1 ) {
$next = array_shift( $parts );
if ( isset( $ref[ $next ] ) && true === $ref[ $next ] ) {
// Skip any sub-properties if their parent prop is already marked for inclusion.
$ref[ $next ] = isset( $ref[ $next ] ) ? $ref[ $next ] : array();
$last = array_shift( $parts );
if ( wp_is_numeric_array( $data ) ) {
foreach ( $data as $item ) {
$new_data[] = _rest_array_intersect_key_recursive( $item, $fields_as_keyed );
$new_data = _rest_array_intersect_key_recursive( $data, $fields_as_keyed );
$response->set_data( $new_data );
* Given an array of fields to include in a response, some of which may be
* `nested.fields`, determine whether the provided field should be included
* If a parent field is passed in, the presence of any nested field within
* that parent will cause the method to return `true`. For example "title"
* will return true if any of `title`, `title.raw` or `title.rendered` is
* @param string $field A field to test for inclusion in the response body.
* @param array $fields An array of string fields supported by the endpoint.
* @return bool Whether to include the field or not.
function rest_is_field_included( $field, $fields ) {
if ( in_array( $field, $fields, true ) ) {
foreach ( $fields as $accepted_field ) {
* Check to see if $field is the parent of any item in $fields.
* A field "parent" should be accepted if "parent.child" is accepted.
if ( str_starts_with( $accepted_field, "$field." ) ) {
* Conversely, if "parent" is accepted, all "parent.child" fields
* should also be accepted.
It is recommended that you Edit text format, this type of Fix handles quite a lot in one request
