WP Rest Api- Update callback (POST request) to existing database table through the rest api

Question

I want to add a POST request functionality, that allows me to
introduce new data rows to the wpso_messages table through the rest
api. Any advise how to accomplish that?

Yes, and note that I wrote this based on the official REST API handbook and the core endpoints.

So from the “Routes and Endpoints → Routes vs Endpoints” section — note the part I highlighted:

A route is the “name” you use to access endpoints, used in the URL.
A route can have multiple endpoints associated with it, and which is used depends on the HTTP verb.

Where “HTTP verb” here is essentially a HTTP request method like GET or POST.

So for example, the core /wp/v2/posts route has 2 endpoints — one with a GET method (for retrieving posts) and the other with a POST method (for creating a post).

Therefore, you could follow the same approach, i.e. add an endpoint to your “messages” route, possibly with the POST method, like so:

// I intentionally used my-plugin as the vendor name, and not "wp". See the
// "Additional Notes" at the bottom in my answer.
register_rest_route( 'my-plugin/v2', 'messages', array(
    // Endpoint 1 - list items.
    array(
        'methods'  => 'GET',
        'callback' => 'get_wp_query',
        // ... other args.
    ),

    // Endpoint 2 - create items.
    array(
        'methods'  => 'POST',
        'callback' => 'my_create_item',
        // ... other args.
    )
) );

function my_create_item( WP_REST_Request $request ) {
    // your code here...
}

_{The actual code that performs the new row/data insertion will depend entirely on you, but you would want to use wpdb::insert().}

Additional Notes

A route’s namespace is composed of <vendor name>/<version>, and you should use your own vendor name, e.g. my-plugin, and not wp. So my-plugin/v2 is good, but wp/v2 shouldn’t be used.

Because the “Routes and Endpoints → Namespaces” section stated:

Do not place anything into the wp namespace unless you are making endpoints with the intention of merging them into core.
Remember to always set a permission callback for your endpoints.

See “Routes and Endpoints → Permissions Callback” and “Adding Custom Endpoints → Permissions Callback” for more details, but for REST API routes that are intended to be public, one can use __return_true() as the permission callback, i.e. 'permission_callback' => '__return_true'.

You would also want to register your endpoint arguments using the args key, and set a validate and sanitize callback which will validate/sanitize the arguments. E.g.

The args for Endpoint 2 above:

// Endpoint 2 - create items.
array(
    'methods'             => 'POST',
    'callback'            => 'my_create_item',
    'permission_callback' => function () {
        // This is just an example of checking the user's permissions..
        return current_user_can( 'edit_posts' );
    },
    'args'                => my_create_item_args(),
)

The my_create_item_args() function:

function my_create_item_args() {
    return array(
        'user_from' => array(
            'required'          => true,
            'validate_callback' => function ( $param ) {
                return is_numeric( $param );
            },
        ),
        'message'   => array(
            'required'          => true,
            'sanitize_callback' => function ( $param ) {
                // this allows basic HTML tags like <strong> and <em>
                return wp_filter_kses( $param );

                // this allows line breaks, but strips all HTML tags
//              return sanitize_textarea_field( $param );
            },
        ),
        // ... other args.
    );
}

Additional Notes

Related Posts: