WordPress REST API for Automated Publishing: The Complete Developer Guide

The WordPress REST API is the backbone of any serious content automation system. It allows external applications to create, read, update, and delete WordPress content without touching wp-admin. If you're building or evaluating an automated publishing workflow, understanding this API is essential.

What Is the WordPress REST API?

Introduced in WordPress 4.7 (2016) and significantly expanded through WordPress 5.x, the REST API provides a standardized HTTP interface to WordPress data. Every post, page, category, tag, user, and media file has a corresponding API endpoint.

The base URL for all REST API requests is:

https://yoursite.com/wp-json/wp/v2/

Authentication: Application Passwords

For automated publishing, the recommended authentication method is WordPress Application Passwords — a native feature available since WordPress 5.6 (no plugins required).

How to create an Application Password:

1. Log in to WordPress Admin → Users → Profile
2. Scroll to the "Application Passwords" section
3. Enter a name (e.g., "AutoPublish") and click "Add New Application Password"
4. Copy the generated password immediately — it won't be shown again

Your authentication header uses HTTP Basic Auth with your WordPress username and the Application Password (not your regular login password):

Authorization: Basic base64(username:application_password)

Creating a Post via the REST API

To create a new WordPress post, send a POST request to /wp-json/wp/v2/posts:

POST https://yoursite.com/wp-json/wp/v2/posts
Content-Type: application/json
Authorization: Basic [encoded credentials]

{
  "title": "Your Article Title",
  "content": "<p>Article content in HTML...</p>",
  "status": "publish",
  "excerpt": "A brief summary of the article",
  "categories": [5],
  "tags": [12, 18],
  "featured_media": 847,
  "meta": {
    "_yoast_wpseo_metadesc": "SEO meta description here",
    "_yoast_wpseo_focuskw": "target keyword"
  }
}

Uploading Featured Images

Featured images must be uploaded separately before creating the post. Use the media endpoint:

POST https://yoursite.com/wp-json/wp/v2/media
Content-Type: image/jpeg
Content-Disposition: attachment; filename="featured-image.jpg"
Authorization: Basic [encoded credentials]

[binary image data]

The response returns the media object including its id, which you then pass as featured_media when creating the post.

Scheduling Posts

To schedule a post for future publication, set status to "future" and include a date in ISO 8601 format:

{
  "status": "future",
  "date": "2025-04-01T09:00:00",
  ...
}

Common Error Responses

HTTP Status	Cause	Fix
401 Unauthorized	Invalid credentials	Verify Application Password; check username
403 Forbidden	User lacks publish permissions	Use an Administrator or Editor account
404 Not Found	REST API disabled	Check if a security plugin is blocking the API
500 Internal Server Error	Plugin conflict or server issue	Check WordPress error logs

Security Best Practices

• Store Application Passwords encrypted — never in plain text or version control
• Create a dedicated WordPress user for API access with the minimum necessary permissions
• Rotate Application Passwords periodically and immediately if a breach is suspected
• Use HTTPS for all API requests — never send credentials over plain HTTP