RESTful JSON API Pro Plugin Features Reference

RESTful JSON API Pro adds the production layer for the free RESTful JSON API plugin.

The free plugin includes the API foundation: Core read utilities, read-only Posts endpoints, the rebuilt User controller, JWT login, API Config, CORS, HTTPS enforcement, and the Documentation tab.

Pro adds:

• Caching,
• Rate Limiting,
• Log,
• Manage Transients,
• post create/update/delete endpoints.

The current plugin is easier for agents such as Claude, Codex, Gemini, Copilot, Grok, or another coding agent to implement because the main patterns of RESTful JSON API Pro are explicit: enable controllers in WordPress, call user/login for a JWT, send Authorization: Bearer YOUR_JWT_TOKEN, read public content through posts/... and core/..., and use Pro for posts/create_post, posts/update_post, and posts/delete_post when the WordPress user has the required capability. The product landing page and the plugin’s Documentation tab are the canonical places to find the current endpoint list.

This article is the current reference for those Pro features.

Caching

What it does: caches successful anonymous read responses as WordPress transients.

Good candidates:

posts/get_recent_posts
posts/get_posts
posts/get_post
posts/get_category_posts
posts/get_post_types
posts/get_taxonomies
posts/get_terms
posts/get_taxonomy_posts
posts/get_media
core/get_page
core/get_menu
core/get_search_results

Never-cache style endpoints:

core/get_nonce
user/signup
user/login
user/validate_token
user/me
user/meta
user/set_meta
user/delete_meta
user/set_meta_many
user/request_password_reset
user/create_comment
posts/create_post
posts/update_post
posts/delete_post

Those endpoints either deal with authentication, current user state, mutation, or write workflows. They should remain fresh.

Settings:

Setting	Purpose
Cache duration	Off, 1h, 3h, 6h, 12h, 24h, 48h, or 72h
Excluded endpoints	Site owner controlled endpoint exclusions
Clear cache	Clear all cache or targeted cached responses

Key behavior: query parameters are normalized before cache key generation, so equivalent parameter order produces the same cache entry while different pages, categories, tags, or authors remain separate.

Rate Limiting

What it does: slows abusive or broken clients with a token-bucket limiter.

Why token bucket: unlike fixed-window counters, token buckets do not have a reset boundary that can be abused with two bursts in two seconds.

Settings:

Setting	Purpose
Limit by	Client IP, API key, or global
Max burst	How many requests can arrive quickly
Sustained rate	How fast tokens refill

When exceeded: the API returns HTTP 429 with a Retry-After header.

Where it runs: early in the request lifecycle, before expensive controller work. This helps protect public reads, JWT auth endpoints, and Pro write endpoints from rapid repeated calls.

Log

What it does: records selected operational API events.

The Log tab is not a full request-body logger. It intentionally avoids storing sensitive request content.

Can record:

• timestamp,
• endpoint,
• current WordPress user ID,
• affected object ID when available,
• IP address.

Does not store:

• passwords,
• JWT tokens,
• raw request bodies,
• submitted post content,
• private payload fields.

Default focus:

posts/create_post
posts/update_post
posts/delete_post
user/signup
user/set_meta
user/delete_meta
user/set_meta_many
user/create_comment

These are the calls most likely to matter in an audit because they create, modify, delete, or submit something.

The log is stored in a WordPress option and capped at 1,000 entries. It is a compact operational audit trail, not a complete request or observability log.

Manage Transients

What it does: gives admins a visible table for API cache entries.

The table is API-specific. It is designed for RESTful JSON API cached responses, not unrelated WordPress transients.

Common actions:

• filter by endpoint,
• inspect cached API rows,
• delete one row,
• bulk delete selected rows,
• delete all RESTful JSON API transients.

Useful after:

• content imports,
• category or tag changes,
• menu edits,
• bulk post updates,
• theme or frontend changes where cached API output should refresh quickly.

Pro Post Write Endpoints

Pro also adds write methods to the Posts controller:

posts/create_post
posts/update_post
posts/delete_post

These are not anonymous endpoints. They are designed for mobile apps, editorial tools, headless dashboards, and AI-built WordPress clients that need to create or manage WordPress content safely.

They require:

1. RESTful JSON API Pro active.
2. A valid Pro license.
3. A valid JWT bearer token.
4. A WordPress user with the required capability.

Supported write features include:

• post_type for posts, pages, and public custom post types,
• taxonomies[...] for custom taxonomy term assignment,
• categories and tags for normal post taxonomy assignment,
• attachment or featured_image file upload fields,
• image_url for remote image sideloading,
• image_data for base64 or PNG data URI uploads,
• featured_media for an existing attachment ID,
• meta[field_name] values during create or update.

The enhanced Pro Posts controller also includes protected taxonomy-term and post-meta methods:

posts/set_post_terms
posts/create_term
posts/update_term
posts/delete_term
posts/get_post_meta
posts/set_post_meta
posts/delete_post_meta

Example:

curl -X POST "https://yoursite.com/api/posts/create_post/" \
  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
  -d "post_type=post" \
  -d "title=Draft from API" \
  -d "content=Created through RESTful JSON API Pro." \
  -d "status=draft" \
  -d "taxonomies[category]=News" \
  -d "image_url=https://example.com/image.png" \
  -d "set_featured_image=1"

For a custom post type, change post_type:

curl -X POST "https://yoursite.com/api/posts/create_post/" \
  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
  -d "post_type=product" \
  -d "title=Mobile app product draft" \
  -d "status=draft" \
  -d "taxonomies[product_cat]=Featured"

License

The License tab activates the Pro plugin for the current site. Pro features remain gated until the license is valid.

The license does not change which plugin file is installed. It unlocks the Pro behavior already present in the Pro add-on:

• live Caching controls,
• live Rate Limiting controls,
• live Log controls,
• live Manage Transients controls,
• protected post write endpoints.

How Pro fits with the free plugin

Use the free plugin when you need:

• public content reads,
• Core utility endpoints,
• JWT login,
• user profile/meta endpoints,
• comment creation through the User controller,
• API Config,
• Documentation.

Use Pro when you need:

• caching,
• traffic throttling,
• API event audit trails,
• cache inspection and clearing,
• post create/update/delete.

That split keeps the free plugin useful while making the paid plugin valuable for production APIs.