WordPress REST API 完全ガイド - 認証・カスタムエンドポイント・ヘッドレスCMS活用まで

# 公開済みの最新投稿を10件
GET /wp-json/wp/v2/posts?per_page=10&orderby=date&order=desc
 
# slug 指定で取得
GET /wp-json/wp/v2/posts?slug=hello-world
 
# 特定カテゴリーで絞り込み
GET /wp-json/wp/v2/posts?categories=5
 
# 必要なフィールドだけ返す
GET /wp-json/wp/v2/posts?_fields=id,title,slug,date
 
# 関連リソースを埋め込む（_embed）
GET /wp-json/wp/v2/posts?_embed

// wp_localize_script() で wpApiSettings.nonce が出力されている前提
fetch(`${wpApiSettings.root}wp/v2/posts/1`, {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'X-WP-Nonce': wpApiSettings.nonce,
  },
  body: JSON.stringify({ title: 'Hello Moon' }),
})
  .then((r) => r.json())
  .then(console.log);

$valid = wp_verify_nonce( $_SERVER['HTTP_X_WP_NONCE'] ?? '', 'wp_rest' );

curl -X GET https://your-site.com/wp-json/wp/v2/posts \
  -u "your-username:ABCD 1234 EFGH 5678 IJKL 9012"

import { Buffer } from "node:buffer";
 
const user = process.env.WP_USER;
const appPass = process.env.WP_APP_PASSWORD; // "ABCD 1234 ..."
const auth = Buffer.from(`${user}:${appPass}`).toString("base64");
 
const res = await fetch("https://your-site.com/wp-json/wp/v2/posts", {
  method: "POST",
  headers: {
    "Authorization": `Basic ${auth}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    title: "API から投稿",
    content: "<p>Hello from Node.js!</p>",
    status: "publish",
  }),
});
 
console.log(await res.json());

add_action( 'rest_api_init', function () {
    register_rest_route( 'mytheme/v1', '/hello', array(
        'methods'             => WP_REST_Server::READABLE, // 'GET'
        'callback'            => 'mytheme_hello',
        'permission_callback' => '__return_true', // 公開ならこれ
    ) );
} );
 
function mytheme_hello( WP_REST_Request $request ) {
    return rest_ensure_response( array(
        'message' => 'Hello, REST!',
        'time'    => current_time( 'mysql' ),
    ) );
}

curl https://your-site.com/wp-json/mytheme/v1/hello
# {"message":"Hello, REST!","time":"2026-05-07 19:30:00"}

add_action( 'rest_api_init', function () {
    register_rest_route( 'mytheme/v1', '/private', array(
        'methods'  => WP_REST_Server::READABLE,
        'callback' => 'mytheme_private_data',
        'permission_callback' => function () {
            if ( ! current_user_can( 'manage_options' ) ) {
                return new WP_Error(
                    'rest_forbidden',
                    __( 'この情報を見る権限がありません', 'mytheme' ),
                    array( 'status' => 401 )
                );
            }
            return true;
        },
    ) );
} );
 
function mytheme_private_data() {
    return rest_ensure_response( array( 'secret' => 'classified' ) );
}

add_action( 'rest_api_init', function () {
    register_rest_route( 'mytheme/v1', '/author/(?P<id>\d+)', array(
        'methods'  => 'GET',
        'callback' => 'mytheme_get_author',
        'args'     => array(
            'id' => array(
                'description'       => '投稿者の ID',
                'type'              => 'integer',
                'required'          => true,
                'validate_callback' => fn( $v ) => is_numeric( $v ) && (int) $v > 0,
                'sanitize_callback' => 'absint',
            ),
        ),
        'permission_callback' => '__return_true',
    ) );
} );
 
function mytheme_get_author( WP_REST_Request $request ) {
    $id   = (int) $request['id'];
    $user = get_userdata( $id );
    if ( ! $user ) {
        return new WP_Error( 'not_found', '投稿者が見つかりません', array( 'status' => 404 ) );
    }
    return rest_ensure_response( array(
        'id'           => $user->ID,
        'display_name' => $user->display_name,
        'posts_count'  => count_user_posts( $user->ID, 'post' ),
    ) );
}

add_action( 'rest_api_init', function () {
    register_rest_route( 'mytheme/v1', '/feedback', array(
        'methods'             => WP_REST_Server::CREATABLE, // 'POST'
        'callback'            => 'mytheme_feedback',
        'permission_callback' => function ( WP_REST_Request $request ) {
            return is_user_logged_in();
        },
        'args' => array(
            'rating'  => array(
                'type'              => 'integer',
                'required'          => true,
                'validate_callback' => fn( $v ) => is_numeric( $v ) && $v >= 1 && $v <= 5,
                'sanitize_callback' => 'absint',
            ),
            'comment' => array(
                'type'              => 'string',
                'required'          => false,
                'sanitize_callback' => 'sanitize_textarea_field',
            ),
        ),
    ) );
} );
 
function mytheme_feedback( WP_REST_Request $request ) {
    $user_id = get_current_user_id();
    $rating  = (int) $request['rating'];
    $comment = (string) ( $request['comment'] ?? '' );
 
    add_user_meta( $user_id, 'mytheme_feedback', compact( 'rating', 'comment' ) );
 
    return rest_ensure_response( array( 'ok' => true ) );
}

type WPPost = {
  id: number
  slug: string
  title: { rendered: string }
  excerpt: { rendered: string }
  date: string
}
 
async function getPosts(): Promise<WPPost[]> {
  const res = await fetch(
    "https://wp.example.com/wp-json/wp/v2/posts?per_page=10&_fields=id,slug,title,excerpt,date",
    { next: { revalidate: 600, tags: ["wp-posts"] } } // 10分キャッシュ + タグ再検証
  )
  if (!res.ok) throw new Error("fetch failed")
  return res.json()
}
 
export default async function BlogIndex() {
  const posts = await getPosts()
  return (
    <ul>
      {posts.map((p) => (
        <li key={p.id}>
          <a href={`/blog/${p.slug}`} dangerouslySetInnerHTML={{ __html: p.title.rendered }} />
        </li>
      ))}
    </ul>
  )
}

add_filter( 'rest_endpoints', function ( $endpoints ) {
    if ( is_user_logged_in() ) {
        return $endpoints;
    }
    foreach ( array( '/wp/v2/users', '/wp/v2/users/(?P<id>[\d]+)' ) as $route ) {
        if ( isset( $endpoints[ $route ] ) ) {
            unset( $endpoints[ $route ] );
        }
    }
    return $endpoints;
} );

add_filter( 'rest_authentication_errors', function ( $result ) {
    if ( ! empty( $result ) ) {
        return $result; // 既にエラー判定済みならそれを尊重
    }
    if ( ! is_user_logged_in() ) {
        return new WP_Error(
            'rest_not_logged_in',
            __( 'REST API は認証が必要です', 'mytheme' ),
            array( 'status' => 401 )
        );
    }
    return $result;
} );