API Routes

The AAM_Framework_Service_ApiRoutes service provides a programmatic interface for managing access permissions to WordPress REST API routes within the AAM Framework.

This service allows developers to:

• Restrict API endpoints
• Explicitly allow endpoints
• Reset route permissions
• Check route access state
• Integrate custom access logic through WordPress filters

# Definition

class AAM_Framework_Service_ApiRoutes {

    public deny(mixed $api_route) : bool
    public allow(mixed $api_route) : bool
    public reset(mixed $api_route = null) : bool

    public is_denied(mixed $api_route) : bool
    public is_allowed(mixed $api_route) : bool

}

# Overview

The API Routes service operates on normalized route identifiers in the following format:

{http_method} {endpoint}

Example:

post /wp/v2/posts
get /aam/v2/jwt
delete /wc/v3/orders

Internally, all identifiers are:

• converted to lowercase
• trimmed
• stored as:

"{method} {endpoint}"

# Supported Route Identifier Formats

The $api_route parameter accepts three different formats.

# 1. WP_REST_Request Instance

The route and method are extracted automatically.

# Example

$request = new WP_REST_Request('POST', '/aam/v2/jwt');

$api_routes->deny($request);

Internally normalized to:

post /aam/v2/jwt

# 2. String Identifier

A string containing the HTTP method and endpoint.

# Example

$api_routes->deny('POST /aam/v2/jwt');

• Method and endpoint must be separated by a space.
• Method is case-insensitive.
• Endpoint should begin with /.

Internally normalized to:

post /aam/v2/jwt

# 3. Associative Array

An array containing method and endpoint keys.

# Example

$api_routes->deny([
    'method'   => 'POST',
    'endpoint' => '/aam/v2/jwt'
]);

Internally normalized to:

post /aam/v2/jwt

# Default HTTP Method Behavior

When only the endpoint is provided as a string, the service automatically assumes the GET method.

# Example

$api_routes->deny('/wp/v2/posts');

Internally normalized to:

get /wp/v2/posts

# Methods

# deny()

Restrict access to a specific API route.

public function deny(mixed $api_route) : bool

# Parameters

# Return Value

# Example

// Restrict JWT endpoint
$api_routes->deny('POST /aam/v2/jwt');

// Restrict WooCommerce order deletion
$api_routes->deny([
    'method'   => 'DELETE',
    'endpoint' => '/wc/v3/orders'
]);

# allow()

Explicitly allow access to an API route.

public function allow(mixed $api_route) : bool

# Parameters

# Return Value

# Example

$api_routes->allow('GET /wp/v2/users/me');

# reset()

Reset permissions for a specific API route or all routes.

public function reset(mixed $api_route = null) : bool

# Parameters

# Return Value

# Example

// Reset Specific Route
$api_routes->reset('POST /aam/v2/jwt');

// Reset All API Route Permissions
$api_routes->reset();

# is_denied()

Check whether an API route is denied.

public function is_denied(mixed $api_route) : bool

# Parameters

# Return Value

# Example

if ($api_routes->is_denied('POST /aam/v2/jwt')) {
    wp_die('Access denied');
}

# is_allowed()

Check whether an API route is allowed.

public function is_allowed(mixed $api_route) : bool

# Parameters

# Return Value

# Example

if ($api_routes->is_allowed('GET /wp/v2/posts')) {
    // Process request
}

# Route Normalization

All route identifiers are normalized through the internal method:

_normalize_resource_identifier()

The normalization process:

1. Extracts method and endpoint
2. Converts both to lowercase
3. Trims whitespace
4. Produces canonical format

Example:

'POST /AAM/V2/JWT'

becomes:

post /aam/v2/jwt

# Exception Handling

If the route identifier cannot be normalized, the service throws an InvalidArgumentException.

# Example Invalid Identifiers

$api_routes->deny([]);
$api_routes->deny('');
$api_routes->deny(['endpoint' => '/wp/v2/posts']);

Result:

InvalidArgumentException: Invalid API Route identifier

# Permission Storage

Permissions are stored through the underlying resource layer:

AAM_Framework_Resource_ApiRoute

using the permission type:

'access'

Internally:

$route => [
    'effect' => 'allow|deny'
]

# WordPress Filter Integration

The service exposes a filter that allows third-party code to influence route access decisions.

# aam_api_route_is_denied_filter

Modify the final denied state for an API route.

# Hook Signature

apply_filters(
    'aam_api_route_is_denied_filter',
    $result,
    $api_route,
    $resource
);

# Parameters

# Example

// Allow administrators to bypass all API restrictions
add_filter(
    'aam_api_route_is_denied_filter',
    function($is_denied) {

        if (current_user_can('administrator')) {
            return false;
        }

        return $is_denied;
    }
);