0 Day Analytics – REST API Module Developer Documentation

<?php
private const OPTION_NAME = ADVAN_PREFIX . 'rest_api_rules';
// Resolves to: aadvana_rest_api_rules

<?php
public const PAGE_SLUG            = ADVAN_INNER_SLUG . '_page_advan_rest_api';
public const SCREEN_OPTIONS_SLUG  = 'advanced_analytics_rest_api_list';
public const SEARCH_INPUT         = 's';
public const MENU_SLUG            = 'advan_rest_api';
public const REST_API_MENU_SLUG   = 'advan_rest_api';
public const NONCE_NAME           = 'advana_rest_api_manager';
public const SAVE_ACTION          = 'advan_rest_api_save';
public const TOGGLE_ACTION        = 'advan_rest_api_toggle';

<?php
// Stored structure: route pattern => rule configuration
$rules = array(
    '/wp/v2/posts' => array(
        'disabled'         => true,              // Fully disable endpoint
        'disabled_methods' => array( 'DELETE' ),  // Disable specific methods only
        'obfuscate'        => true,              // Hide from REST index
    ),
    '/wp/v2/users/(?P<id>[\d]+)' => array(
        'disabled_methods' => array( 'PUT', 'PATCH', 'DELETE' ),
    ),
);

<?php
$endpoint = array(
    'route'         => '/wp/v2/posts',
    'route_hash'    => 'abc123def456',  // First 12 chars of MD5 hash
    'methods'       => array( 'GET', 'POST' ),
    'namespace'     => 'wp/v2',
    'show_in_index' => true,
    'is_public'     => false,  // true if no permission_callback or __return_true
    'status'        => 'active', // active | disabled | partial
);

<?php
$csv_row = array(
    'Route'    => '/wp/v2/posts',
    'Methods'  => 'GET, POST',
    'Namespace'=> 'wp/v2',
    'In Index' => 'Yes',
    'Access'   => 'Protected',
    'Status'   => 'Active',
);

<?php
use ADVAN\Helpers\Rest_Api_Helper;

// Disable the users endpoint entirely.
$rules = Rest_Api_Helper::get_endpoint_rules();
$rules['/wp/v2/users'] = array(
    'disabled' => true,
);
Rest_Api_Helper::save_endpoint_rules( $rules );

<?php
use ADVAN\Helpers\Rest_Api_Helper;

// Allow GET but block POST, PUT, PATCH, DELETE on /wp/v2/posts.
$rules = Rest_Api_Helper::get_endpoint_rules();
$rules['/wp/v2/posts'] = array(
    'disabled_methods' => array( 'POST', 'PUT', 'PATCH', 'DELETE' ),
);
Rest_Api_Helper::save_endpoint_rules( $rules );

<?php
use ADVAN\Helpers\Rest_Api_Helper;

// Hide /wp/v2/users from the REST API index but keep it functional.
$rules = Rest_Api_Helper::get_endpoint_rules();
$rules['/wp/v2/users'] = array(
    'obfuscate' => true,
);
Rest_Api_Helper::save_endpoint_rules( $rules );

<?php
use ADVAN\Helpers\Rest_Api_Helper;

// Obfuscate AND restrict DELETE on /wp/v2/posts.
$rules = Rest_Api_Helper::get_endpoint_rules();
$rules['/wp/v2/posts'] = array(
    'disabled_methods' => array( 'DELETE' ),
    'obfuscate'        => true,
);
Rest_Api_Helper::save_endpoint_rules( $rules );

<?php
use ADVAN\Helpers\Rest_Api_Helper;

// Get all endpoints and filter to those with no authentication requirement.
$all_endpoints = Rest_Api_Helper::get_all_endpoints();
$public = array_filter( $all_endpoints, function ( $ep ) {
    return ! empty( $ep['is_public'] );
} );

foreach ( $public as $ep ) {
    printf(
        "Route: %s | Methods: %s | Namespace: %s\n",
        $ep['route'],
        implode( ', ', $ep['methods'] ),
        $ep['namespace']
    );
}

<?php
use ADVAN\Helpers\Rest_Api_Helper;

// Disable every endpoint under the "custom-plugin/v1" namespace.
$all_endpoints = Rest_Api_Helper::get_all_endpoints();
$rules         = Rest_Api_Helper::get_endpoint_rules();

foreach ( $all_endpoints as $ep ) {
    if ( 'custom-plugin/v1' === $ep['namespace'] ) {
        $rules[ $ep['route'] ] = array( 'disabled' => true );
    }
}

Rest_Api_Helper::save_endpoint_rules( $rules );

<?php
use ADVAN\Helpers\Rest_Api_Helper;

// Clear all rules — re-enables everything.
Rest_Api_Helper::save_endpoint_rules( array() );

<?php
use ADVAN\Helpers\Rest_Api_Helper;

$rules = Rest_Api_Helper::get_endpoint_rules();
$route = '/wp/v2/users';

if ( isset( $rules[ $route ]['disabled'] ) && $rules[ $route ]['disabled'] ) {
    echo 'Endpoint is fully disabled.';
} elseif ( ! empty( $rules[ $route ]['disabled_methods'] ) ) {
    echo 'Partially restricted. Disabled methods: '
        . implode( ', ', $rules[ $route ]['disabled_methods'] );
} else {
    echo 'Endpoint is fully active.';
}

<?php
// An endpoint is considered public if ANY of its handlers meets these criteria:
$is_public = ! isset( $handler['permission_callback'] )
    || empty( $handler['permission_callback'] )
    || '__return_true' === $handler['permission_callback'];

<?php
// A stored rule for the pattern:
// /wp/v2/posts/(?P<id>[\d]+)
//
// Will match requests to:
// /wp/v2/posts/42
// /wp/v2/posts/123
//
// The conversion uses:
$regex = '#^' . $route_pattern . '$#';
// e.g. #^/wp/v2/posts/(?P<id>[\d]+)$#