WordPress REST API for Automated Publishing: The Complete Developer Guide

The WordPress REST API is the backbone of any serious content automation system. It allows external applications to create, read, update, and delete WordPress content without touching wp-admin. If you're building or evaluating an automated publishing workflow, understanding this API is essential.

What Is the WordPress REST API?

Introduced in WordPress 4.7 (2016) and significantly expanded through WordPress 5.x, the REST API provides a standardized HTTP interface to WordPress data. Every post, page, category, tag, user, and media file has a corresponding API endpoint.

The base URL for all REST API requests is:

https://yoursite.com/wp-json/wp/v2/

Authentication: Application Passwords

For automated publishing, the recommended authentication method is WordPress Application Passwords — a native feature available since WordPress 5.6 (no plugins required).

How to create an Application Password:

1. Log in to WordPress Admin → Users → Profile
2. Scroll to the "Application Passwords" section
3. Enter a name (e.g., "AutoPublish") and click "Add New Application Password"
4. Copy the generated password immediately — it won't be shown again

Your authentication header uses HTTP Basic Auth with your WordPress username and the Application Password (not your regular login password). For a turnkey approach to WordPress REST API publishing automation, AutoPublish handles all of this under the hood.

Authorization: Basic base64(username:application_password)

Creating a Post via the REST API

To create a new WordPress post, send a POST request to /wp-json/wp/v2/posts:

POST https://yoursite.com/wp-json/wp/v2/posts
Content-Type: application/json
Authorization: Basic [encoded credentials]

{
  "title": "Your Article Title",
  "content": "<p>Article content in HTML...</p>",
  "status": "publish",
  "excerpt": "A brief summary of the article",
  "categories": [5],
  "tags": [12, 18],
  "featured_media": 847,
  "meta": {
    "_yoast_wpseo_metadesc": "SEO meta description here",
    "_yoast_wpseo_focuskw": "target keyword"
  }
}

Uploading Featured Images

Featured images must be uploaded separately before creating the post. Use the media endpoint:

POST https://yoursite.com/wp-json/wp/v2/media
Content-Type: image/jpeg
Content-Disposition: attachment; filename="featured-image.jpg"
Authorization: Basic [encoded credentials]

[binary image data]

The response returns the media object including its id, which you then pass as featured_media when creating the post.

Scheduling Posts

To schedule a post for future publication, set status to "future" and include a date in ISO 8601 format:

{
  "status": "future",
  "date": "2025-04-01T09:00:00",
  ...
}

Common Error Responses

Security Best Practices

• Store Application Passwords encrypted — never in plain text or version control
• Create a dedicated WordPress user for API access with the minimum necessary permissions
• Rotate Application Passwords periodically and immediately if a breach is suspected
• Use HTTPS for all API requests — never send credentials over plain HTTP