WP REST API Toolkit

Extensible WordPress REST API layer. Adds a versioned /wprat/v2/ namespace with advanced product endpoints, JWT token authentication, per-route rate limiting, and automatic response envelope wrapping.

Features

• Namespaced Endpoints — /wprat/v2/products, /wprat/v2/auth/token
• JWT Authentication — issue, validate, and refresh HMAC-SHA256 signed tokens
• Rate Limiting — configurable requests-per-window per IP per route (transient-backed)
• Response Envelope — consistent { success, data, meta } wrapper on all responses
• Field Projection — ?fields=id,name,price to trim response payloads
• Cursor Pagination — ?after= datetime for efficient large dataset traversal
• Advanced Product Filtering — category, price range, search, per-page

API Reference

Authentication

Issue Token

POST /wp-json/wprat/v2/auth/token
Content-Type: application/json

{ "username": "admin", "password": "secret" }

Validate Token

GET /wp-json/wprat/v2/auth/validate
Authorization: Bearer <token>

Products

List Products

GET /wp-json/wprat/v2/products?category=shirts&min_price=10&max_price=100&fields=id,name,price&per_page=20
Authorization: Bearer <token>

Get Product

GET /wp-json/wprat/v2/products/42

Update Product

PATCH /wp-json/wprat/v2/products/42
Authorization: Bearer <token>
Content-Type: application/json

{ "regular_price": "29.99", "stock_quantity": 50 }

Response Format

All endpoints return a consistent envelope:

{
  "success": true,
  "data": { ... },
  "meta": {
    "version": "2.0.0",
    "timestamp": "2025-01-15T12:00:00+00:00"
  }
}

Project Structure

wp-rest-api-toolkit/
├── src/
│   ├── Plugin.php                          # Bootstrap, rate limit filter, response transformer
│   ├── Endpoints/
│   │   ├── ProductsController.php          # WP_REST_Controller — products CRUD + filtering
│   │   ├── AuthController.php              # JWT token issuance and validation
│   │   └── MediaController.php
│   └── RateLimit/
│       └── Limiter.php                     # Transient-backed rate limiter
├── tests/
├── composer.json
└── wp-rest-api-toolkit.php

Configuration

Add to wp-config.php to use a custom JWT secret:

define( 'WPRAT_JWT_SECRET', 'your-strong-secret-here' );

Adjust rate limit defaults by filtering:

add_filter( 'wprat_rate_limit_max', fn() => 120 );    // requests
add_filter( 'wprat_rate_limit_window', fn() => 60 );  // seconds

Installation

composer install

Activate the plugin in WordPress admin > Plugins.

License

GPL-2.0+ — see LICENSE.