REST API endpoints for sites by lloc · Pull Request #13055 · WordPress/wordpress-develop

lloc · 2026-08-14T15:07:28Z

Trac ticket: https://core.trac.wordpress.org/ticket/40365

There are some open questions that we should discuss in the trac ticket.

github-actions · 2026-08-14T15:07:37Z

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Unlinked Accounts

The following contributors have not linked their GitHub and WordPress.org accounts: @jonnydmg.

Contributors, please read how to link your accounts to ensure your work is properly credited in WordPress releases.

Core Committers: Use this line as a base for the props when committing in SVN:

Props realloc, spacedmonkey, peterwilsoncc, biont.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

github-actions · 2026-08-14T15:10:32Z

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

All changes will be lost when closing a tab with a Playground instance.
All changes will be lost when refreshing the page.
A fresh instance is created each time the link below is clicked.
Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

jonnydmg

There is a big PR to review. Good work getting this ready for core. This code a little old and some things have changed in core, so this PR needs to update accordingly.

Biggest things.

We need to support sites with is_site_meta_supported false. There was some work done there to support it but not complete.
Site endpoint needs to be registered on single site. So it always exists then return an error on single site.
WP_REST_Site_Meta_Fields has no test coverage at all.
Single site needs tests.
Super admin should be allowed to do everything on the endpoint.
Code coverage and ticket need needs to be added to every test.

This feel like we are on the right track, if I am nitpicing here, becuase I think this good to go into core and just want to get the final bits to push forward into core.

I will wait until feedback is complete to do some real testing for this PR.

jonnydmg · 2026-08-21T15:21:24Z

+ * @since 7.2.0
+ *
+ * @group restapi
+ * @group ms-required


We should have another test file for with all the tests related to it not being multisite, as there are lots of checks for is_mulitiste. There are so many this feels like a good fit for another file instead of excloding each test one at a time.

jonnydmg

There is a big PR to review. Good work getting this ready for core. This code a little old and some things have changed in core, so this PR needs to update accordingly.

Biggest things.

We need to support sites with is_site_meta_supported false. There was some work done there to support it but not complete.
Site endpoint needs to be registered on single site. So it always exists then return an error on single site.
WP_REST_Site_Meta_Fields has no test coverage at all.
Single site needs tests.
Super admin should be allowed to do everything on the endpoint.
Code coverage and ticket need needs to be added to every test.

This feel like we are on the right track, if I am nitpicing here, becuase I think this good to go into core and just want to get the final bits to push forward into core.

I will wait until feedback is complete to do some real testing for this PR.

Introduces WP_REST_Sites_Controller plus tests. See #40365.

spacedmonkey · 2026-08-28T14:16:00Z

@lloc I have put together a little PR for tests for all the meta changes -lloc#1

…and add missing group annotations

spacedmonkey

Here is a PR with some unit test improvements.

lloc#2

This is has unit tests that cover single site as well.

…oint-tests Tests: Add unit tests for WP_REST_Site_Meta_Fields functionality

…oint-more-tests Tests: Rename rest-sites-controller.php to wpRestSitesController.php …

…pdating sites

Add format validation for the `domain` and `path` parameters in WP_REST_Sites_Controller so malformed values are rejected with a clean 400 rest_invalid_param instead of failing later inside wp_insert_site()/ wp_update_site() (which surfaces as a 500). domain must be a valid hostname or bare IPv4/IPv6 address, optionally followed by a port (bracketed IPv6 is intentionally not supported, so IPv6 addresses can't carry a port). path must start and end with a forward slash and be made up of characters valid in a URL path segment. Ticket #40365.

…t-check-exists' into feature/40365-rest-sites-endpoint-check-exists # Conflicts: # src/wp-includes/rest-api/endpoints/class-wp-rest-sites-controller.php

spacedmonkey · 2026-09-11T16:21:33Z

I have more feedback here.

lloc#4
lloc#3

This fixes some issues that were flagged by ai.

…oint-force-delete Enhance site deletion process to support force deletion and user removal

…oint-check-exists Check if domain exists before creating / updating.

peterwilsoncc

I've added a few notes inline.

The highest priority issue is the permission check revealing whether or not a site exists to unauthenticated/unauthorized users.

peterwilsoncc · 2026-09-23T04:04:33Z

+		$parameter_mappings = array(
+			'domain'          => 'domain__in',
+			'domain_exclude'  => 'domain__not_in',
+			'exclude'         => 'site__not_in',
+			'include'         => 'site__in',
+			'offset'          => 'offset',
+			'order'           => 'order',
+			'network'         => 'network__in',
+			'network_exclude' => 'network__not_in',
+			'per_page'        => 'number',
+			'path'            => 'path__in',
+			'path_exclude'    => 'path__not_in',
+			'search'          => 'search',
+			'public'          => 'public',
+			'archived'        => 'archived',
+			'mature'          => 'mature',
+			'spam'            => 'spam',
+			'deleted'         => 'deleted',
+			'lang_id'         => 'lang__in',
+			'lang_id_exclude' => 'lang__not_in',
+		);


The wp_blogs table includes only a couple of indexes:

blog_id (blog_id) -- Primary key

domain (domain(50),path(5))

lang_id (lang_id)

I think it would be good to reduce the list of get parameters down a little to avoid allowing site users to construct very inefficient queries.

I'm not suggesting removing all of the unindexed parameters but being a little picky about those that are included. For example I think network and network_exclude would need to be retained but some consideration can be taken to public, archived, etc.

One approach may be to limit the query to type = (public|archived...).

peterwilsoncc · 2026-09-23T04:20:31Z

+			return true;
+		}
+
+		return new WP_Error( 'rest_forbidden_context', __( 'Sorry, you are not allowed to edit sites.' ), array( 'status' => rest_authorization_required_code() ) );


This is a read not an edit request.

peterwilsoncc · 2026-09-23T04:37:24Z

+		if ( is_wp_error( $site ) ) {
+			return $site;
+		}
+


Move this down to after the context/current_user_can( 'manage_sites' ) check.

Placed here it will reveal to unathorized users whether the site exists, so people will be able to figure out the size of the network.

On an MS instance with fewer than 5000 sub-sites, visit http://localhost/wp-json/wp/v2/sites/5000 while logged out to see what I mean.

🔢 Note, this applies to most of the permission checks so you'll need to make this change throughout.

peterwilsoncc · 2026-09-23T04:53:13Z

+	 * @param WP_REST_Request $request       The current request.
+	 * @return true|WP_Error True if the domain and path are available, WP_Error otherwise.
+	 */
+	protected function check_domain_is_available( $prepared_site, $request ) {


Suggested change

protected function check_domain_is_available( $prepared_site, $request ) {

protected function check_url_is_available( $prepared_site, $request ) {

It checks both domain and path. This will require changes elsewhere.

Biont · 2026-09-24T08:14:52Z

Quick question: Does this entirely supersede #9626? Let me know if there are any gaps or if we can simply close the other one.

…ler.php Co-authored-by: Peter Wilson <519727+peterwilsoncc@users.noreply.github.com>

REST API endpoints for sites

225beea

lloc added 2 commits August 19, 2026 16:04

Merge branch 'trunk' into feature/40365-rest-sites-endpoint

088f7b7

Merge branch 'trunk' into feature/40365-rest-sites-endpoint

5c7205d

jonnydmg suggested changes Aug 21, 2026

View reviewed changes

REST API: Add sites endpoints

cc81250

Introduces WP_REST_Sites_Controller plus tests. See #40365.

lloc force-pushed the feature/40365-rest-sites-endpoint branch from aa03545 to cc81250 Compare August 22, 2026 07:51

lloc and others added 3 commits August 26, 2026 10:36

REST API: Drop is_super_admin() from sites checks

b447451

Merge branch 'trunk' into feature/40365-rest-sites-endpoint

b3ff7ed

Tests: Add unit tests for WP_REST_Site_Meta_Fields functionality

375b136

Tests: Rename rest-sites-controller.php to wpRestSitesController.php …

b7a51db

…and add missing group annotations

spacedmonkey reviewed Aug 28, 2026

View reviewed changes

Comment thread tests/phpunit/tests/rest-api/wpRestSitesController.php

lloc and others added 7 commits September 2, 2026 15:48

Merge pull request #1 from spacedmonkey/feature/40365-rest-sites-endp…

0197d37

…oint-tests Tests: Add unit tests for WP_REST_Site_Meta_Fields functionality

Merge pull request #2 from spacedmonkey/feature/40365-rest-sites-endp…

829c066

…oint-more-tests Tests: Rename rest-sites-controller.php to wpRestSitesController.php …

Enhance site deletion process to support force deletion and user removal

1a4ddf8

Tests: Add validation for existing domain and path when creating or u…

13c56ee

…pdating sites

Remove redundant cache update call in site creation process

8fe0b65

Merge remote-tracking branch 'fork-1/feature/40365-rest-sites-endpoin…

9ca95a1

…t-check-exists' into feature/40365-rest-sites-endpoint-check-exists # Conflicts: # src/wp-includes/rest-api/endpoints/class-wp-rest-sites-controller.php

lloc added 3 commits September 11, 2026 18:55

Merge pull request #3 from spacedmonkey/feature/40365-rest-sites-endp…

cee5f71

…oint-force-delete Enhance site deletion process to support force deletion and user removal

Merge pull request #4 from spacedmonkey/feature/40365-rest-sites-endp…

a8889ee

…oint-check-exists Check if domain exists before creating / updating.

Merge branch 'trunk' into feature/40365-rest-sites-endpoint

396291c

spacedmonkey reviewed Sep 18, 2026

View reviewed changes

Comment thread tests/qunit/fixtures/wp-api-generated.js Outdated

spacedmonkey added 2 commits September 18, 2026 15:03

Apply suggestion from @spacedmonkey

586589d

Merge branch 'trunk' into feature/40365-rest-sites-endpoint

06c7410

spacedmonkey reviewed Sep 18, 2026

View reviewed changes

Comment thread tests/phpunit/tests/rest-api/wpRestSiteMetaFields.php Outdated

Apply suggestion from @spacedmonkey

a6430fb

peterwilsoncc requested changes Sep 23, 2026

View reviewed changes

lloc and others added 3 commits September 28, 2026 07:01

Update src/wp-includes/rest-api/endpoints/class-wp-rest-sites-control…

b178b2f

…ler.php Co-authored-by: Peter Wilson <519727+peterwilsoncc@users.noreply.github.com>

Update src/wp-includes/rest-api/endpoints/class-wp-rest-sites-control…

8b519ff

…ler.php Co-authored-by: Peter Wilson <519727+peterwilsoncc@users.noreply.github.com>

Update src/wp-includes/rest-api/endpoints/class-wp-rest-sites-control…

797e119

…ler.php Co-authored-by: Peter Wilson <519727+peterwilsoncc@users.noreply.github.com>

	protected function check_domain_is_available( $prepared_site, $request ) {
	protected function check_url_is_available( $prepared_site, $request ) {

Conversation

lloc commented Aug 14, 2026

Uh oh!

github-actions Bot commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Unlinked Accounts

Uh oh!

github-actions Bot commented Aug 14, 2026

Test using WordPress Playground

Some things to be aware of

Uh oh!

jonnydmg left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jonnydmg Aug 21, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jonnydmg left a comment

Choose a reason for hiding this comment

Uh oh!

spacedmonkey commented Aug 28, 2026

Uh oh!

spacedmonkey left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

spacedmonkey commented Sep 11, 2026

Uh oh!

Uh oh!

Uh oh!

peterwilsoncc left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

peterwilsoncc Sep 23, 2026

Choose a reason for hiding this comment

Uh oh!

peterwilsoncc Sep 23, 2026

Choose a reason for hiding this comment

Uh oh!

peterwilsoncc Sep 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

peterwilsoncc Sep 23, 2026

Choose a reason for hiding this comment

Uh oh!

Biont commented Sep 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

github-actions Bot commented Aug 14, 2026 •

edited

Loading