Disable part of endpoints wordpress api

The routes in question have two or three default endpoints:

  • /wp/v2/users — it has two endpoints, one GET and one POST, i.e. “List Users” (GET /wp/v2/users), and “Create a User” (POST /wp/v2/users).

  • /wp/v2/users/<id> — it has three endpoints, one GET, one POST and one DELETE, i.e. “Retrieve a User” (GET /wp/v2/users/<id>), “Update a User” (POST /wp/v2/users/<id>), and “Delete a User” (DELETE /wp/v2/users/<id>).

So in your code, you can unset the array (which represents an endpoint with specific HTTP request methods) in a route, if the request method is GET.

Working Example

function disable_custom_rest_endpoints( $endpoints ) {
    $routes = array( '/wp/v2/users', '/wp/v2/users/(?P<id>[\d]+)' );

    foreach ( $routes as $route ) {
        if ( empty( $endpoints[ $route ] ) ) {
            continue;
        }

        foreach ( $endpoints[ $route ] as $i => $handlers ) {
            if ( is_array( $handlers ) && isset( $handlers['methods'] ) &&
                'GET' === $handlers['methods'] ) {
                unset( $endpoints[ $route ][ $i ] );
            }
        }
    }

    return $endpoints;
}

Tried & tested working on WordPress 5.7.2 — only the GET /wp/v2/users and GET /wp/v2/users/<id> endpoints got removed/disabled.