WordPress REST API: scaffold, review, secure

Use this skill for inbound REST endpoints. Prefer REST for new, versioned plugin APIs and external clients. Keep outbound HTTP integrations in wp-http-api-client and use admin-ajax only for a concrete legacy or WP-admin-specific reason.

Read reference.md for dispatch/auth debugging, controllers, collections, register_rest_field(), and edge-case verification.

Core execution model

Apply this order when reviewing behavior: