Post types: Permissions and REST API tabs

Both tabs appear when Advanced settings is on in the post type editor (Custom post types).

Permissions tab

How capabilities work

With Custom capability names off, the type uses the same capabilities as Posts (edit_posts, publish_posts, edit_others_posts and so on). Anyone who can edit posts can edit this type.

With it on, WordPress builds the capability names from your two bases. With singular dbook and plural dbooks you get edit_dbook, edit_dbooks, edit_others_dbooks, publish_dbooks, read_private_dbooks, delete_dbooks and so on.

To let editors or another role in, give them the capabilities with a role editor plugin, or in code:

$role = get_role( 'editor' );
foreach ( array( 'edit_dbooks', 'edit_others_dbooks', 'publish_dbooks', 'delete_dbooks' ) as $cap ) {
	$role->add_cap( $cap );
}

Capabilities already granted stay on the role if you later switch custom names off or rename the bases. If you only want to restrict the type to a different existing capability, leave custom names off and filter wpmcf/post_types/register_args instead.

Keep Map meta capabilities on unless you know why you need it off; with it off WordPress will not translate "edit this post" into the right per-post checks.

Capability bases are cleaned like keys: lowercase letters, numbers, hyphens and underscores.

Export and deleting users

Allow export only affects Tools › Export of WordPress. It is unrelated to the JSON export of definitions under WPM Fields › Tools.

Delete with user is a destructive setting. Leave it off unless the posts only make sense with their author (for example user-owned profiles).

REST API tab

The REST API is what the block editor uses to load and save entries, and what headless front ends and apps use to read your content.

The base, namespace and controller fields only apply while Show in the REST API is on.

Example

A type with key book, REST base books, default namespace:

GET /wp-json/wp/v2/books
GET /wp-json/wp/v2/books/123

The list screen shows "On" in the REST API column for types that are exposed.

Reading private content through the REST API still needs authentication; only published entries of a public type are visible without logging in.

Field values in the REST API

Per field group, values can appear under a wpmcf key in the REST response of the post types the group is located on (see Field groups). This requires the type to be shown in the REST API.

Troubleshooting

A non-administrator cannot see the type. Custom capability names are on and the capabilities are not granted to that role. See the note above.

The block editor does not open for my type. Check Show in the REST API is on and that Supports includes editor.

My REST base returns a 404. Use pretty permalinks (not Plain) and make sure no other type or taxonomy already uses the same base.