What this prompt does
This prompt extends the WordPress REST API for a given [use_case]. It creates custom endpoints under /wp-json/[namespace]/v1/ from your [endpoints] list, adds authentication via [auth_method], validates requests with WP_REST_Request schemas, formats responses with WP_REST_Response, adds pagination headers, field filtering via ?_fields=, transient caching with a [cache_ttl] TTL, rate limiting of [rate_limit] per [rate_window], a batch endpoint, and custom permission callbacks for your [permission_model].
The structure works because a predictable API needs the same plumbing every time — auth, validation, pagination, and caching — done consistently. Namespacing under [namespace] keeps your endpoints separate from core. Schema validation and WP_REST_Response formatting make the API contract explicit, while the [cache_ttl] and rate limiting protect the backend when a mobile app or headless frontend hammers it.
When to use it
- You're building a backend for a
[use_case]like a mobile app or headless frontend - You need custom
[endpoints]namespaced under your own[namespace] - You want consistent auth via
[auth_method]such as JWT with Application Passwords fallback - You need pagination headers and field filtering for efficient clients
- You want transient caching at
[cache_ttl]and rate limiting to protect the backend - You need role-based permission callbacks for your
[permission_model]
Example output
Expect REST plumbing: registered routes under /wp-json/[namespace]/v1/ for each of your [endpoints], an auth layer using [auth_method], request schema validation, WP_REST_Response formatting with X-WP-Total and X-WP-TotalPages headers, field filtering support, transient caching at [cache_ttl], rate limiting, a batch endpoint, and permission callbacks — plus a Postman collection, a fetch wrapper, and PHPUnit tests per endpoint.
Pro tips
- Keep
[endpoints]RESTful and noun-based; consistent naming makes the[namespace]API predictable for client developers - Choose
[auth_method]to match your clients — JWT suits mobile apps, Application Passwords suit server-to-server - Review the generated permission callbacks against your
[permission_model]carefully; weak permissions are the top REST security risk - Tune
[cache_ttl]per endpoint — long TTLs help read-heavy routes but serve stale data for fast-changing content - Test rate limiting under realistic load so
[rate_limit]protects the backend without blocking legitimate clients - Run the generated PHPUnit tests and Postman collection to verify each endpoint's contract before clients integrate
