Is it a good idea to restrict the REST API

You can use the rest_dispatch_request filter to catch the /wp/v2/users routes before they deliver their data to the user.


add_filter( 'rest_dispatch_request', 'wpse425815_authenticate_user_route', 10, 4 );
/**
 * Forces authentication on the wp/v2/user route(s).
 *
 * @param  mixed      $result  The current result.
 * @param  WP_Request $request The REST request.
 * @param  string     $route   The requested route.
 * @param  array      $handler The REST handler.
 * @return mixed|WP_Error      Error if unpermitted; otherwise return $result.
 */
function wpse425815_authenticate_user_route( $result, $request, $route, $handler ) {
    if (
        false !== strpos( $route, '/wp/v2/users' ) &&
        ! current_user_can( 'edit_others_posts' )
    ) {
        return new \WP_Error(
            'rest_auth_required',
            'Authentication required',
            array( 'status' => 401 )
        );
    }
    return $result;
}

I’ve tried this code on a local installation, and it ~~seems to do what you’re asking (ie, only allow authenticated users at Editor and above to view the /wp/v2/users REST data)~~ disables direct, unauthenticated access to the /wp/v2/users route (eg https://example.com/wp-json/wp/v2/users` will return a 401) and disables use by the backend of user data for users below Editor level (eg, this disables specifying the author of a post in the Block Editor).

Test it before you use it in production.

References

This answer builds on the code snippet provided here: https://rinat.dev/blog/2020/03/04/how-to-lock-down-wordpress-rest-api-endpoints-or-completely-disable-them/#rest-dispatch-request .

References

Related Posts: