Skip to main content

benecaster_rest_permission_admin()

Utilities Free 
benecaster_rest_permission_admin( WP_REST_Request $request ): bool|WP_Error

Permission callback for an add-on REST route that requires a site admin. It checks manage_options and then a valid wp_rest nonce, exactly as Benecaster’s own admin endpoints do — this and RestController::permission_callback_admin() call the same implementation, so they cannot drift apart.

The shape is already right for direct use: WordPress passes the request to a permission_callback, so pass the function name as a string and nothing else.

Register your routes in your own namespace, not benecaster/v1. That namespace is Benecaster’s, and its route list is not a stable place for third-party endpoints to appear.

Parameters

Name Type Default Required Description
$request WP_REST_Request — Yes The request WordPress passes in. You never construct this yourself.

Return Value

Type: bool|WP_Error

True when permitted; a WP_Error with a 403 status when the capability check or the nonce fails.

Example

add_action( 'rest_api_init', function (): void {
    register_rest_route( 'my-addon/v1', '/settings', [
        'methods'             => 'POST',
        'callback'            => 'my_addon_save_settings',
        'permission_callback' => 'benecaster_rest_permission_admin',
    ] );
} );

Notes

This exists so add-ons stop extending RestController — do not extend it. Extending a base class is the most brittle coupling available: every protected method, property and constructor signature silently becomes API that can never change. The permission check was the only part an add-on actually needed from that class, and register_rest_route() on rest_api_init covers everything else.

It returns WP_Error, not a bare false, and you should keep it that way. WordPress turns the WP_Error into a 403 carrying a message that says which check failed; a bare false produces a flat, unexplained refusal that is markedly harder to debug from the browser console.

This is the admin check only — there is no public function for the editor (edit_posts) or subscriber (logged-in) callbacks. That is a deliberate narrowing rather than an oversight: only the admin check had recipes pointing at it. Please do not report the other two as missing. An add-on that needs one should raise it, and it would get its own function rather than being smuggled in behind an argument here.

Need this built rather than just documented? See our services →