Loading today’s stories
Build1 distinct publisher2 min readUpdated
A dev.to walkthrough moves the permission check out of the callback and clamps per_page at 100. The version string in the namespace is the cheap part that costs most later.
The Engineer · Build desk
Compiled by The EngineerSomething wrong?How this is made
The source's checklist has five terms: who can access, what data they can access, what input is accepted, what output is returned, and what happens when something fails [3]. Only one of them ends up declared where a reader can find it. The permission decision moves out of the function body into `permission_callback`, so the registration itself states the rule [6]. The `page` and `per_page` handling stays inside the callback, reading `$request->get_param` and clamping values there [8]. The route declaration therefore says who may call it and says nothing about what it accepts.
That clamp is the one line that changes an operator's arithmetic. `per_page` is forced to at least 1 and no more than 100 [8], so a client that wants ten thousand records makes at least a hundred calls instead of one [1]. The server stops being asked for unbounded result sets [8], and the client inherits a paging loop it did not have before. Worth doing, but it is a transfer of work rather than a free safety measure, and it belongs in whatever you hand to the people writing the client.
The error side is where the contract earns its keep. `WP_Error` returns a machine-readable code, an HTTP status and, optionally, the field that failed, in place of a string like "Something went wrong" [11]. Across the examples there are three distinct statuses: 403 when the capability check fails [5], 400 for an email that does not validate [9], 404 for a post ID that does not resolve [10]. Three branches a client can write against with confidence [2].
`myplugin/v1` costs nothing to type [1] and commits you to the expensive half later, because a version boundary only pays if v1 keeps answering after v2 ships [4]. The rename example makes the failure concrete: `id` and `title` becoming `post_id` and `name` breaks clients that were reading the old keys [12]. The guide also allows that not every small change needs a new version [12], which leaves the hardest call, where additive ends and breaking begins, with the person shipping it.
One sequencing detail is worth copying. The existence check runs first, `get_post` and a 404 if nothing comes back, and the application's authorization rules run after that [10]. Existence and permission are separate questions [10], and answering them in that order means any caller who cleared the `permission_callback` [6] can distinguish "no such post" from "not yours". Whether that is acceptable is a decision about the resource, not about REST.
Follow any of these and your For You feed starts watching them — no settings page required.
Ranked by verification strength, evidence, and original report placement.
A route registered with register_rest_route() using namespace 'myplugin/v1' and route '/posts' creates an endpoint at /wp-json/myplugin/v1/posts.
The dev.to guide argues the difficult part is not registering an endpoint but designing it so that authentication, authorization, validation, error handling and data access are all handled correctly.
The guide states a production API needs a contract covering who can access it, what data they can access, what input is accepted, what output is returned, and what happens when something fails.
Using a versioned namespace such as myplugin/v1 gives the API a version boundary, so if the response structure changes later a new version can be introduced without immediately breaking existing clients.
A common beginner implementation puts the check inside the callback: if the current user cannot 'manage_options', return a WP_Error with code 'forbidden', message 'Access denied' and status 403.
WordPress provides permission_callback as a cleaner place for the permission decision, giving the separation request, permission check, callback, data.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Verifiable code, single uncorroborated source
Every technical assertion is concrete and checkable against WordPress core primitives (register_rest_route, permission_callback, absint, sanitize_email/is_email, get_post, WP_Error, transients) and the article's code blocks are internally consistent. But the cluster contains exactly one document from one author with no core-documentation citation, no benchmark, and no second publisher to corroborate the normative recommendations, which caps evidence strength well below the level the prescriptive 'the right way' framing implies.
No adoption evidence supplied
The cluster contains no release, deployment, usage disclosure, benchmark or download data. The article asserts that WordPress is used as a backend for apps, dashboards and mobile clients but supplies no numbers, and nothing in the material indicates how widely these specific patterns are implemented. Inferring adoption from the general popularity of WordPress would go beyond the supplied sources.
Mildly overstated by prescriptive framing
Slightly positive: the headline promises 'the Right Way' and the text presents single-author preferences as production requirements, while the substance is a standard, modest set of core-API patterns with no evidence that they outperform alternatives. The gap stays small because the concrete claims are accurate and unembellished — no performance numbers, no scale claims, no product pitch — and the author explicitly hedges on caching and versioning ('don't cache everything', 'you don't necessarily need a new version for every small change').
Low: community tutorial, no product on offer
Observable incentive pressure is low. The article is a developer-community post that promotes no product, service, vendor, sponsor, course or paid tier; the recommended tools are all WordPress core functions with no commercial beneficiary. The residual incentive is the ordinary reputational and engagement benefit of publishing authoritative-sounding developer content on dev.to, which plausibly explains the absolutist 'the Right Way' title. No disclosure of affiliation is present either way.
Confident on content, blind on real-world uptake
Confidence is high that the article says what these claims report and that its code-level assertions are correct, since the supplied body text is complete enough to check each snippet. Confidence is low on anything beyond the text: with one publisher, no adoption or benchmark data, and no counter-source, the assessment cannot judge whether these practices are prevalent or whether the prescriptive advice holds at scale.
build
Six MariaDB versions, one real difference: the only reason to leave 10.6 is the July 2026 clock1 distinct publisher
build
Block themes move who controls layout, not just how templates are written1 distinct publisher
build
Your agent does not need every MCP tool, and the toolbox is the liability1 distinct publisher
build
Three manual interventions in a month, and every guard was working as designed1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
dev.to
1 article · August 22, 2026