REST API

This page describes the REST API that RestroPress 3.4.11 registers under the rp/v1 namespace. It covers the 22 routes the plugin registers (21 resource routes plus the namespace index), how to authenticate, the parameters each method accepts and the responses you get back.

Base URL#

All routes live under the WordPress REST base:

https://example.com/wp-json/rp/v1

If pretty permalinks are off, use https://example.com/?rest_route=/rp/v1. A GET on the base URL returns the standard WordPress namespace index with every route, its methods and its arguments, which is the quickest way to inspect what a given site exposes.

Menu items are exposed as /food; orders as /order; categories and add-on categories under /fooditem/. Request and response bodies are JSON. Send Content-Type: application/json on every POST, PUT and PATCH; the order and cart routes read the raw JSON body.

Enabling the API and getting credentials#

In the WordPress admin go to RestroPress, Settings, General, then the Developer API section. The section has these entries:

• What is available: a description of the API and the base URL.
• Enable Token Endpoint (setting activate_api): lets logged-in, authorized users request a token from /rp/v1/auth. The description in the settings screen states that it does not control the normal REST routes.
• Recommended connection flow: choose a WordPress user for the integration, create a WordPress Application Password for it, and call the routes with HTTP Basic Authentication.
• About the token endpoint: states that the protected controllers check the authenticated WordPress user and their capabilities.

There is no screen in 3.4.11 that generates or lists RestroPress API keys. The data-access routes work without enabling anything: the only credentials you need are a WordPress user with the right capability and an Application Password (WordPress, Users, your profile, Application Passwords). WordPress only offers Application Passwords on HTTPS sites unless the environment type is local.

Notes. Settings only controls the /auth route. A site with the setting off still serves every other route to an authenticated user.

Authentication#

Every route except the namespace index requires an authenticated WordPress user. The permission callbacks in this version all do the same check: the user must be logged in and hold a capability.

Routes	Required capability
/food, /order, /cart, /customers, /others/*, /fooditem/categories, /fooditem/addons and their sub-routes	manage_shop_settings
/reports/*	view_shop_reports
/auth	Logged in, edit_user on the requested user, and the token endpoint enabled

An unauthenticated or under-privileged request gets this response:

HTTP/1.1 401 Unauthorized

{"code":"rest_forbidden","message":"Authentication failed. Please check your credentials.","data":{"status":401}}

The message can be changed with the rp_api_auth_error_message filter. Two ways to authenticate work in practice:

• Application Password. Send HTTP Basic Authentication with the WordPress username and the Application Password. This is the right choice for servers and mobile apps.
• Cookie and nonce. Browser code on the same site sends the X-WP-Nonce header with a wp_rest nonce. WordPress rejects a cookie request with a missing or invalid nonce.

The token endpoint#

GET /rp/v1/auth issues an HS512 JSON Web Token. It is checked in this order, each failure returning the 4xx shown:

1. The token endpoint setting activate_api is on, otherwise 401 API has not enabled!!!..
2. The request is authenticated as a WordPress user, otherwise 401 You must be logged in to generate API tokens..
3. The x-user-id header (or user_id query parameter) names a user the caller can edit_user, otherwise 403 You are not allowed to generate an API token for this user..
4. An x-api-key header (or an Authorization header that is not a Bearer value) is present, otherwise 403 A valid API key is required to generate a token..

The token is signed with the key you send in x-api-key. It carries iat, nbf, jti, iss, aud and data.user_id, plus exp when the api_expire setting holds a relative time such as 1 hour. The payload also contains the key you sent in data.api_key, so the token must be treated as secret. The rp_api_token_generate_data filter can change the payload.

Notes. No route in 3.4.11 accepts the issued token. The permission callbacks never read x-api-key or a Bearer header, so a request that sends only a token gets the 401 above. The key is also not compared with any stored value. api_expire has no field on the settings screen; it is read from the stored settings only.

Conventions#

• List routes accept page and per_page; for post-based routes (menu items, orders) the response carries X-WP-Total and X-WP-TotalPages headers.
• Use _fields=id,price on any route that returns WordPress posts or terms to trim the response.
• Deleting a menu item or order moves it to the trash unless you pass force=true. Terms cannot be trashed and need force=true.
• Unknown IDs on the post-based routes return rest_post_invalid_id with status 404.

Status	Meaning
200	Success. Also returned by customer creation.
201	Resource created (menu items, orders, categories, add-on categories).
400	Invalid input, for example empty_content on a menu item without title, content or excerpt, a missing required parameter, Email already existed. for a duplicate customer or an empty cart on order creation.
401	Not authenticated or missing capability. The customer routes also use 401 for an unknown ID.
403	Failed nonce for cookie authentication, or a refused token request.
404	Unknown ID on menu item, order, category and add-on routes.
501	rest_trash_not_supported: deleting a term without force=true.

Route index#

Route	Methods
/rp/v1	GET
/rp/v1/auth	GET
/rp/v1/food	GET, POST
/rp/v1/food/{id}	GET, POST/PUT/PATCH, DELETE
/rp/v1/order	GET, POST
/rp/v1/order/{id}	GET, POST/PUT/PATCH, DELETE
/rp/v1/order/statuses	GET
/rp/v1/order/update-status/{id}/{order_status}	POST/PUT/PATCH
/rp/v1/cart	GET, POST, PUT/PATCH, DELETE
/rp/v1/customers	GET, POST
/rp/v1/customers/{id}	GET, POST/PUT/PATCH, DELETE
/rp/v1/reports/count	GET
/rp/v1/reports/sales-earnings	GET
/rp/v1/reports/best-selling	GET
/rp/v1/reports/payment-methods	GET
/rp/v1/others/statuses	GET
/rp/v1/others/services	GET
/rp/v1/others/tax	GET
/rp/v1/fooditem/categories	GET, POST
/rp/v1/fooditem/categories/{id}	GET, POST/PUT/PATCH, DELETE
/rp/v1/fooditem/addons	GET, POST
/rp/v1/fooditem/addons/{id}	GET, POST/PUT/PATCH, DELETE

In the examples below, USER is a WordPress username with manage_shop_settings and APP_PASSWORD is an Application Password.

Namespace index#

GET /rp/v1#

Standard WordPress namespace discovery. Parameters: context (default view). Returns namespace, routes (each with methods, endpoints and args) and _links. It needs no authentication.

Token#

GET /rp/v1/auth#

Issues a token. Headers: x-user-id (or query user_id) and x-api-key. See the Authentication section for the checks.

Parameter	Type	Required	Description
user_id	integer	Yes	Target user ID, also accepted as the x-user-id header. Must be a user the caller may edit.
x-api-key (header)	string	Yes	Key used to sign the token.

Response (200): {"token":"<jwt>"}. A signing failure returns 401 with message and an X-WP-RP-error header.

Example, from a logged-in browser session (cookie and nonce):

fetch('/wp-json/rp/v1/auth?user_id=1', {
  credentials: 'same-origin',
  headers: { 'X-WP-Nonce': wpApiSettings.nonce, 'x-api-key': 'my-signing-key' }
}).then(r => r.json()).then(console.log);

Menu items#

Menu items are the fooditem post type, served by a controller that extends the WordPress posts controller, so the standard post parameters apply.

GET /rp/v1/food#

Lists menu items.

Parameter	Type	Required	Description
context	string	No	Scope of the request: view, embed or edit. Default view.
page	integer	No	Current page of the collection. Default 1.
per_page	integer	No	Maximum number of items per page. Default 10.
search	string	No	Limit results to those matching a string.
after	string	No	Only items published after this ISO 8601 date.
modified_after	string	No	Only items modified after this ISO 8601 date.
before	string	No	Only items published before this ISO 8601 date.
modified_before	string	No	Only items modified before this ISO 8601 date.
exclude	array	No	Exclude these IDs.
include	array	No	Limit the result to these IDs.
search_semantics	string	No	How to interpret search. Only exact is accepted.
offset	integer	No	Skip this many items.
order	string	No	asc or desc. Default desc.
orderby	string	No	One of author, date, id, include, modified, parent, relevance, slug, include_slugs, title. Default date.
search_columns	array	No	Columns to search.
slug	array	No	Limit the result to one or more slugs.
author	array	No	Limit to specific author IDs.
author_exclude	array	No	Exclude specific author IDs.
status	array	No	Limit to one or more post statuses. Default publish.
tax_relation	string	No	AND or OR between taxonomy filters.
food-category	array	No	Limit to menu items in these category term IDs.
food-category_exclude	array	No	Exclude menu items in these category term IDs.
dietary	array	No	Limit to these dietary term IDs.
dietary_exclude	array	No	Exclude these dietary term IDs.
food_type	string	No	veg or non_veg.
with_addons	string	No	true or false. When truthy the response adds food_addons and addons. Any non-empty value, including false, is treated as true.
orderby_sales	string	No	true or false. Orders by sales count. Any non-empty value, including false, is treated as true.

Response (200): an array of menu items. Each has the standard post fields (id, guid, modified, slug, status, type, link, title, content, excerpt, author, featured_media) plus food-category, dietary, food_type, is_single_price_mode, has_variable_prices, is_free, can_purchase, is_quantities_disabled, price, variable_prices, variable_price_label, sku, sales, earnings, food_categories, featured_media_url, thumbnail and have_addons.

curl -u "USER:APP_PASSWORD" "https://example.com/wp-json/rp/v1/food?per_page=5&food_type=veg&_fields=id,title,price"

POST /rp/v1/food#

Creates a menu item. WordPress needs at least a title, content or excerpt, otherwise it returns 400 empty_content.

Parameter	Type	Required	Description
title	string	No	Menu item name.
slug	string	No	Unique slug.
status	string	No	Post status, for example publish or draft.
content	object	No	Description.
excerpt	object	No	Excerpt.
author	integer	No	Author user ID.
featured_media	integer	No	Media ID of the image.
food-category	array	No	Category term IDs (WordPress taxonomy field).
dietary	array	No	Dietary term IDs.
price	number	No	Price, stored as rpress_price.
sku	string	No	SKU.
food_type	string	No	Food type, for example veg.
food_categories	array	No	Category term IDs, assigned with wp_set_post_terms.
has_variable_prices	boolean	No	Enable variable pricing.
variable_prices	array	No	List of objects with name and amount. Only read when has_variable_prices is true.
variable_price_label	string	No	Label for the variation selector. Only read when has_variable_prices is true.
food_addons	object	No	Add-on groups keyed by add-on category term ID. Each group has category, max_addons, is_required, items (term IDs), prices and default.
is_single_price_mode, fodditem_type, is_free, is_quantities_disabled, can_purchase	various	No	Declared in the schema and returned in responses; the create and update handler does not store them.

Response (201): the created menu item, as in the list response, with a Location header.

curl -u "USER:APP_PASSWORD" -X POST -H "Content-Type: application/json" \
  -d '{"title":"Garlic Bread","status":"publish","price":5,"food_type":"veg","sku":"GB-1","food_categories":[10]}' \
  https://example.com/wp-json/rp/v1/food

GET /rp/v1/food/{id}#

Parameter	Type	Required	Description
id	integer	Yes	Menu item ID (in the URL).
context	string	No	view, embed or edit.
excerpt_length	integer	No	Override the excerpt length.

Response (200): one menu item. Unknown ID: 404 rest_post_invalid_id.

POST, PUT or PATCH /rp/v1/food/{id}#

Updates a menu item. Accepts the same body fields as creation plus id. Only the fields you send are changed; price, SKU and food type are written only when non-empty.

curl -u "USER:APP_PASSWORD" -X PUT -H "Content-Type: application/json" -d '{"price":8}' https://example.com/wp-json/rp/v1/food/14

DELETE /rp/v1/food/{id}#

Parameter	Type	Required	Description
id	integer	Yes	Menu item ID.
force	boolean	No	Bypass the trash. Default false.

Response (200): without force, the trashed item. With force=true, {"deleted":true,"previous":{...}}.

Notes. with_addons and orderby_sales treat the string false as true. orderby_sales replaces the meta_key used by food_type, so using both together returns no items.

Orders#

Orders are the rpress_payment post type. List and read use the WordPress posts controller; create and update are custom and read their values from the JSON body.

GET /rp/v1/order#

Parameter	Type	Required	Description
context	string	No	Scope of the request: view, embed or edit. Default view.
page	integer	No	Current page of the collection. Default 1.
per_page	integer	No	Maximum number of items per page. Default 10.
search	string	No	Limit results to those matching a string.
after	string	No	Only items published after this ISO 8601 date.
modified_after	string	No	Only items modified after this ISO 8601 date.
before	string	No	Only items published before this ISO 8601 date.
modified_before	string	No	Only items modified before this ISO 8601 date.
exclude	array	No	Exclude these IDs.
include	array	No	Limit the result to these IDs.
search_semantics	string	No	How to interpret search. Only exact is accepted.
offset	integer	No	Skip this many items.
order	string	No	asc or desc. Default desc.
orderby	string	No	One of author, date, id, include, modified, parent, relevance, slug, include_slugs, title. Default date.
search_columns	array	No	Columns to search.
slug	array	No	Limit the result to one or more slugs.
order_status	array	No	Limit to these order statuses (keys from /order/statuses).
service_type	array	No	Limit to these service types.
payment_status	array	No	Limit to these payment statuses (pending, publish, refunded, failed, processing, abandoned).
customer	integer	No	Customer ID.
start_date	string	No	Start of a date range.
end_date	string	No	End of a date range.
gateway	string	No	Payment gateway ID.
search_in_notes	string	No	Search in order notes.
fooditem	array	No	Menu item IDs contained in the order.

Response (200): an array of orders. Fields: id, status, type, delivery_adrress_meta, order_note, total, subtotal, tax, discounted_amount, tax_rate, fees_total, discounts, discount_amount, date, completed_date, status_nicename, gateway, gateway_nicename, post_status, user_id, customer_id, ip, service_type, service_type_name, order_status, service_date, service_time, plus the stored payment meta (key, email, user_info, fooditems, cart_details, fees, currency).

curl -u "USER:APP_PASSWORD" "https://example.com/wp-json/rp/v1/order?order_status[]=pending&per_page=20"

POST /rp/v1/order#

Creates an order from the JSON body. The order is created with status processing, then moved to status if one is sent; order_status is stored and may trigger the customer notification.

Parameter	Type	Required	Description
cart_details	array	No	Order lines (JSON body). Each line: id (menu item ID), price_id, price, item_price, discount, quantity, instruction, addon_items (list of addon_item_name, addon_id, price, quantity). Required on create: an empty cart returns 400.
customer	object	No	Used only for users with manage_shop_settings: id, email, first_name, last_name, phone, discount, address.
delivery_adrress_meta	object	No	Delivery address (the key is spelled this way): address, flat, postcode, city, and on create state.
status	string	No	Payment status, for example pending, publish, processing.
order_status	string	No	Order status key from /order/statuses, for example pending or completed.
service_type	string	No	Service type, for example delivery or pickup.
service_date, service_time	string	No	Service date and time.
gateway	string	No	Payment gateway ID.
order_note	string	No	Order instructions.
price, subtotal, tax	number	No	Totals passed to rpress_insert_payment().
fees	array	No	Fees added to the order.
discounts, discount_amount, phone	string	No	Discount code, discount amount and phone number.

Response (201): the new order. An empty cart returns 400 {"message":"Cart is empty please add some item than you can place an order."}.

curl -u "USER:APP_PASSWORD" -X POST -H "Content-Type: application/json" \
  -d '{"order_status":"pending","status":"pending","service_type":"pickup","gateway":"manual","price":5,"subtotal":5,"customer":{"email":"jane@example.com","first_name":"Jane","last_name":"Doe"},"cart_details":[{"id":14,"quantity":1,"item_price":5,"price":5}]}' \
  https://example.com/wp-json/rp/v1/order

GET /rp/v1/order/{id}#

Parameter	Type	Required	Description
id	integer	Yes	Order ID.
context	string	No	view, embed or edit.

Response (200): one order.

POST, PUT or PATCH /rp/v1/order/{id}#

Updates an order from the JSON body. Accepts the same fields as creation.

Notes. Update always writes service_time, service_date, service_type, gateway and order_note (to empty strings when omitted) and removes existing fees before adding the ones you send. Send the full set of values every time.

DELETE /rp/v1/order/{id}#

Parameter	Type	Required	Description
id	integer	Yes	Order ID.
force	boolean	No	Bypass the trash. Default false.

Response (200): the trashed order, or {"deleted":true,"previous":{...}} with force=true.

GET /rp/v1/order/statuses#

No parameters. Response (200): statuses (key to label), status_colors, payment_statuses and payment_colors. The order status keys are pending, accepted, processing, ready, transit, cancelled and completed unless extended.

curl -u "USER:APP_PASSWORD" https://example.com/wp-json/rp/v1/order/statuses

POST, PUT or PATCH /rp/v1/order/update-status/{id}/{order_status}#

Parameter	Type	Required	Description
id	integer	Yes	Order ID (in the URL).
order_status	string	Yes	Order status key, lowercase letters and hyphens (in the URL).

Sets the order status and sends the customer notification when that status has notifications enabled. The status completed also marks the order paid. Response (200): {"message":"Order status successfully updated."}.

curl -u "USER:APP_PASSWORD" -X POST https://example.com/wp-json/rp/v1/order/update-status/223/accepted

Notes. The route does not check that the order or the status exists. A nonexistent ID still returns the success message.

Cart#

The cart routes work on the cart in the session of the authenticated request (the same cart the front end uses). A client must therefore keep the session cookie between calls; calls that do not will see an empty cart. Request bodies are read as JSON.

GET /rp/v1/cart#

No parameters. Response (200): fees, subtotal, discount, tax, price and cart_details (each line: name, id, item_price, quantity, discount, subtotal, tax, fees, price, addon_items, instruction). An empty cart returns {"message":"Cart is empty"} with status 200.

curl -u "USER:APP_PASSWORD" -c cookies.txt -b cookies.txt https://example.com/wp-json/rp/v1/cart

POST /rp/v1/cart#

Adds the lines to the cart and returns the cart as in the GET response.

Parameter	Type	Required	Description
cart_details	array	Yes	List of lines. Each line takes id (required, menu item ID), price_id, price, item_price, discount, quantity, instruction and addon_items (objects with addon_item_name, addon_id, price, quantity).

curl -u "USER:APP_PASSWORD" -c cookies.txt -b cookies.txt -X POST -H "Content-Type: application/json" \
  -d '{"cart_details":[{"id":14,"quantity":2,"instruction":"No butter"}]}' \
  https://example.com/wp-json/rp/v1/cart

PUT or PATCH /rp/v1/cart#

Sets the quantity of each line (matched by position and menu item ID) and returns the cart.

Parameter	Type	Required	Description
cart_details	array	Yes	List of lines. Each line takes id (required, menu item ID), price_id, price, item_price, discount, quantity, instruction and addon_items (objects with addon_item_name, addon_id, price, quantity).

DELETE /rp/v1/cart#

Empties the cart. No parameters. Response (200): {"message":"Successfully cart emptied"}.

Customers#

GET /rp/v1/customers#

Lists customers from the RestroPress customers table.

Parameter	Type	Required	Description
page	integer	No	Page. Default 1.
per_page	integer	No	Items per page. Default 10.
search	string	No	Search string.
order	string	No	Default DESC.
orderby	string	No	Default id.
email	string	No	Match by email.
id	integer	No	Match by customer ID.
user_id	integer	No	Match by linked user ID.
name	string	No	Match by name.
meta_key, meta_value	string	No	Match by customer meta.
include, exclude	array	No	Customer IDs to include or exclude.
users_include, users_exclude	array	No	User IDs to include or exclude.
meta_query	string	No	Meta query string.
date	object	No	Object with start and end.

Response (200): an array of customers: ID, user_id, emails, email, name, purchase_value, purchase_count and date_created.

curl -u "USER:APP_PASSWORD" "https://example.com/wp-json/rp/v1/customers?per_page=20&orderby=id&order=DESC"

POST /rp/v1/customers#

Parameter	Type	Required	Description
email	string	Yes	Primary email address.
emails	array	No	Additional email addresses.
name	string	No	Customer name.

Response (200): the new customer. A duplicate email returns 400 {"message":"Email already existed."}; a missing email returns 400 rest_missing_callback_param.

curl -u "USER:APP_PASSWORD" -X POST -H "Content-Type: application/json" -d '{"email":"jane@example.com","name":"Jane Doe"}' https://example.com/wp-json/rp/v1/customers

GET /rp/v1/customers/{id}#

Takes the same query parameters as the list route plus id. Response (200): one customer. Unknown ID: 401 {"message":"Please check ID you are providing"}.

POST, PUT or PATCH /rp/v1/customers/{id}#

Parameter	Type	Required	Description
id	integer	Yes	Customer ID.
email	string	No	Primary email.
emails	array	No	Email addresses.
name	string	No	Name.

Response (200): the updated customer, or 401 for an unknown ID.

DELETE /rp/v1/customers/{id}#

Parameter	Type	Required	Description
id	integer	Yes	Customer ID.
force	boolean	No	Accepted but ignored.

Response (200): {"deleted":1,"previous":{...}}. The customer row is deleted permanently.

Notes. Customer creation returns 200 rather than 201, the identifier key is ID (upper case), unknown IDs return 401 and force has no effect.

Reports#

Reports need view_shop_reports. Dates are interpreted with PHP strtotime.

GET /rp/v1/reports/count#

Parameter	Type	Required	Description
start_date	string	No	Start date (YYYY-MM-DD).
end_date	string	No	End date. Defaults to start_date when omitted.
page, per_page, search, context	various	No	Declared by the base controller; not used by the handler.

Response (200): payments_count (counts per payment status), orders_count (counts per order status), customer_count (total, new) and product_count (menu item counts per status). Without dates it covers all time.

curl -u "USER:APP_PASSWORD" "https://example.com/wp-json/rp/v1/reports/count?start_date=2026-10-01&end_date=2026-10-31"

GET /rp/v1/reports/sales-earnings#

Parameter	Type	Required	Description
start_date	string	No	Start date (YYYY-MM-DD).
end_date	string	No	End date. Defaults to start_date when omitted.
page, per_page, search, context	various	No	Declared by the base controller; not used by the handler.

Response (200): an array of daily rows {"total":"94","d":"19","m":"10","y":"2026"} with the earnings for each day.

GET /rp/v1/reports/best-selling#

Parameter	Type	Required	Description
start_date	string	No	Start date (YYYY-MM-DD).
end_date	string	No	End date. Defaults to start_date when omitted.
page, per_page, search, context	various	No	Declared by the base controller; not used by the handler.

Response (200): an array of {"fooditem_id":"14","sales":"64"}. The date parameters are accepted but ignored.

GET /rp/v1/reports/payment-methods#

Parameter	Type	Required	Description
start_date	string	No	Start date (YYYY-MM-DD).
end_date	string	No	End date. Defaults to start_date when omitted.
page, per_page, search, context	various	No	Declared by the base controller; not used by the handler.

Response (200): one object per gateway: ID, label, complete_sales, pending_sales, total_sales, total_earnings and total_tax.

Store information#

Three read-only helper routes with no parameters.

GET /rp/v1/others/statuses#

Same response as /order/statuses.

GET /rp/v1/others/services#

Response (200): {"services":{"delivery":"Delivery","pickup":"Pickup"}} with the enabled service types.

GET /rp/v1/others/tax#

Response (200): {"message":"Successful","data":{"is_enable":false,"is_prices_include":false,"name":"Estimated Tax","rate":"0%","currency":"$"}}.

curl -u "USER:APP_PASSWORD" https://example.com/wp-json/rp/v1/others/services

Menu item categories#

These routes wrap the food-category taxonomy with the WordPress terms controller. Responses include the term and a _links object that points at the matching /wp/v2/food-category routes.

GET /rp/v1/fooditem/categories#

Parameter	Type	Required	Description
context	string	No	view, embed or edit. Default view.
page	integer	No	Page. Default 1.
per_page	integer	No	Items per page. Default 10.
search	string	No	Search string.
exclude	array	No	Exclude IDs.
include	array	No	Limit to IDs.
order	string	No	asc or desc. Default asc.
orderby	string	No	id, include, name, slug, include_slugs, term_group, description or count. Default name.
hide_empty	boolean	No	Hide terms with no items. Default false.
parent	integer	No	Limit to children of this term ID.
post	integer	No	Limit to terms assigned to this item ID.
slug	array	No	Limit to slugs.

Response (200): an array of terms: id, count, description, link, name, slug, taxonomy, parent, meta.

curl -u "USER:APP_PASSWORD" "https://example.com/wp-json/rp/v1/fooditem/categories?hide_empty=false&per_page=50"

POST /rp/v1/fooditem/categories#

Parameter	Type	Required	Description
name	string	Yes	Term name (required on create).
description	string	No	Description.
slug	string	No	Slug.
parent	integer	No	Parent term ID.
meta	object	No	Meta fields.

Response (201): the new term.

curl -u "USER:APP_PASSWORD" -X POST -H "Content-Type: application/json" -d '{"name":"Pizzas"}' https://example.com/wp-json/rp/v1/fooditem/categories

GET /rp/v1/fooditem/categories/{id}#

Parameter	Type	Required	Description
id	integer	Yes	Term ID.
context	string	No	view, embed or edit.

POST, PUT or PATCH /rp/v1/fooditem/categories/{id}#

Parameter	Type	Required	Description
id	integer	Yes	Term ID.
name	string	No	Term name.
description	string	No	Description.
slug	string	No	Slug.
parent	integer	No	Parent term ID.
meta	object	No	Meta fields.

DELETE /rp/v1/fooditem/categories/{id}#

Parameter	Type	Required	Description
id	integer	Yes	Term ID.
force	boolean	Yes	Must be true; terms cannot be trashed.

Response (200): {"deleted":true,"previous":{...}}. Without force=true: 501 rest_trash_not_supported.

Add-on categories#

These routes wrap the addon_category taxonomy with the WordPress terms controller. Responses include the term and a _links object that points at the matching /wp/v2/addon_category routes.

GET /rp/v1/fooditem/addons#

Parameter	Type	Required	Description
context	string	No	view, embed or edit. Default view.
page	integer	No	Page. Default 1.
per_page	integer	No	Items per page. Default 10.
search	string	No	Search string.
exclude	array	No	Exclude IDs.
include	array	No	Limit to IDs.
order	string	No	asc or desc. Default asc.
orderby	string	No	id, include, name, slug, include_slugs, term_group, description or count. Default name.
hide_empty	boolean	No	Hide terms with no items. Default false.
parent	integer	No	Limit to children of this term ID.
post	integer	No	Limit to terms assigned to this item ID.
slug	array	No	Limit to slugs.

Response (200): an array of terms: id, count, description, link, name, slug, taxonomy, parent, meta.

curl -u "USER:APP_PASSWORD" "https://example.com/wp-json/rp/v1/fooditem/addons?hide_empty=false&per_page=50"

POST /rp/v1/fooditem/addons#

Parameter	Type	Required	Description
name	string	Yes	Term name (required on create).
description	string	No	Description.
slug	string	No	Slug.
parent	integer	No	Parent term ID.
meta	object	No	Meta fields.

Response (201): the new term.

curl -u "USER:APP_PASSWORD" -X POST -H "Content-Type: application/json" -d '{"name":"Extra toppings"}' https://example.com/wp-json/rp/v1/fooditem/addons

GET /rp/v1/fooditem/addons/{id}#

Parameter	Type	Required	Description
id	integer	Yes	Term ID.
context	string	No	view, embed or edit.

POST, PUT or PATCH /rp/v1/fooditem/addons/{id}#

Parameter	Type	Required	Description
id	integer	Yes	Term ID.
name	string	No	Term name.
description	string	No	Description.
slug	string	No	Slug.
parent	integer	No	Parent term ID.
meta	object	No	Meta fields.

DELETE /rp/v1/fooditem/addons/{id}#

Parameter	Type	Required	Description
id	integer	Yes	Term ID.
force	boolean	Yes	Must be true; terms cannot be trashed.

Response (200): {"deleted":true,"previous":{...}}. Without force=true: 501 rest_trash_not_supported.

Extending the API#

• restropress_rest_api_get_rest_namespaces filters the namespaces and controllers registered by the server.
• rp_rest_api_fooditem_schema and rp_rest_api_rpress_payment_schema add fields to the menu item and order schemas; rest_rp_cart_item_schema and rest_rp_customer_item_schema do the same for the cart and customer schemas.
• rp_api_auth_error_message changes the 401 message of the protected routes.
• rp_api_token_generate_data changes the token payload; rp_api_token_generate_error_message and rp_api_not_enabled_error_message change the /auth messages.
• jwt_auth_cors_allow_headers changes the Access-Control-Allow-Headers value (default: X-Requested-With, Content-Type, x-api-key, Accept, Origin, Authorization).