Your WordPress site doesn't only talk to web browsers. Mobile apps, other websites and even the block editor talk to it through the REST API. It is a way for other programs to read and update your site's content by sending simple web requests.
It has been part of WordPress core since version 4.7, and you use it every day without noticing.
The REST API in Simple Words
API stands for Application Programming Interface, and REST stands for Representational State Transfer. Don't worry about the big words. The REST API is nothing but a set of URLs, called endpoints, that send and receive data in JSON, a plain text format that programs read easily.
Think of it like a counter at the post office. You hand over a request on a standard form, and you get a standard reply back, without ever going into the back room.
For example, open yoursite.com/wp-json/wp/v2/posts in your browser, and you will see your latest published posts as JSON data.
Where Does WordPress Use the REST API?
- The block editor uses it to load and save your posts.
- Mobile apps and other services use it to publish content remotely.
- Developers use it to build "headless" sites, where WordPress stores the content and a separate front end shows it.
- Plugins use it to load data in the dashboard without a page reload.
This is why an invalid JSON error often appears in the editor when something blocks the REST API.
Is the REST API Safe?
Yes. Anyone can read public data, such as your published posts, but creating or editing content needs authentication. Since WordPress 5.6, you can create Application Passwords under Users → Profile for apps that need access, without sharing your real password.
Don't switch off the REST API completely, because the block editor and many plugins depend on it. Before you make any change, read our guide on how to disable JSON REST API in WordPress.
That's the WordPress REST API in simple words. If you have any doubts, ask us in the comment section below.