AAM

API routes

Overview

Manage access to WordPress REST routes by HTTP method and route. Select the subject with AAM::api()->api_routes($access_level, $settings). Omit $access_level to use the current user or visitor.

PHP class: AAM_Framework_Service_ApiRoutes.

Method reference

Method Purpose
deny($api_route) Store a deny rule.
allow($api_route) Store an allow rule.
reset($api_route = null) Remove one rule or all rules for this level.
is_denied($api_route) Check the effective deny decision.
is_allowed($api_route) Check the effective allow decision.

Return values vary by method. Rule updates usually return bool; reads can return a value, null, or an array. Errors follow the service’s error_handling setting and may produce WP_Error.

Accepted identifiers

Pass one of these forms to deny(), allow(), reset(), or a decision method:

$route = 'POST /wp/v2/posts';                                // Method and route
$route = '/wp/v2/posts';                                     // Route only: defaults to GET
$route = ['method' => 'POST', 'endpoint' => '/wp/v2/posts'];  // Separate fields
$route = new WP_REST_Request('POST', '/wp/v2/posts');         // Request object
AAM::api()->api_routes('role:editor')->deny($route);

Each assignment shows an alternative way to set $route; the final call uses the request object. The method is part of the rule: GET /wp/v2/posts and POST /wp/v2/posts identify different targets. Include it explicitly whenever a route supports several methods.

Example

$routes = AAM::api()->api_routes('role:subscriber');
$routes->deny('POST /wp/v2/posts');
if ($routes->is_denied('POST /wp/v2/posts')) {
    // Stop a custom request flow.
}

The route string contains both the HTTP method and path. This blocks Subscriber POST requests to /wp/v2/posts; the check reads the same route decision for a custom REST flow.

Developer notes

Behavior and parameters