How to block external access to register_rest_route callback?

When registering a route with register_rest_route() you can provide a permission_callback which is a function that checks whether the user has permission to use the endpoint. If only Administrator users should be able to use the endpoint then you can check for the manage_options capability in the callback, like this: register_rest_route( ‘myplugin/v1’, ‘update-rmp”, array( ‘permission_callback’ … Read more

Calling a Rest API with parameters on button Click

@TomJNowell pointed you the way to go. You have to enqueue a JS file, and within this JS file you can use any technique to do the REST request, like an XMLHttpRequest object or the fetch API. The REST API itself, of course, is part of WordPress, and defined with register_rest_route(). It is also something … Read more