Gunjan Jaswal

EndPointy Menus adds custom REST API routes to expose your WordPress navigation menus as JSON.
Base namespace: <code>endpointy-menus/v1</code>
Endpoints:
<ul>
<li>
<code>GET /wp-json/endpointy-menus/v1/menus</code> 
Returns all registered menus with locations and items.
</li>
<li>
<code>GET /wp-json/endpointy-menus/v1/menus/<id></code> 
Returns a single menu and its items by menu ID.
</li>
<li>
<code>GET /wp-json/endpointy-menus/v1/locations</code> 
Returns all registered menu locations with assigned menus.
</li>
<li>
<code>GET /wp-json/endpointy-menus/v1/locations/<location></code> 
Returns a menu assigned to a specific location (e.g., ‘primary’, ‘footer’).
</li>
</ul>
Query Parameters:
<ul>
<li><code>nested=true</code> – Returns menu items in a hierarchical tree structure with parent-child relationships. 
Example: <code>/wp-json/endpointy-menus/v1/menus/2?nested=true</code></li>
</ul>
This is useful for headless WordPress setups or any external app that needs to read your menu structure.
<h3>Usage</h3>
Example requests:
Get all menus: 
 https://your-site.com/wp-json/endpointy-menus/v1/menus
Get single menu by ID: 
 https://your-site.com/wp-json/endpointy-menus/v1/menus/2
Get all menu locations: 
 https://your-site.com/wp-json/endpointy-menus/v1/locations
Get menu by location (e.g., ‘primary’): 
 https://your-site.com/wp-json/endpointy-menus/v1/locations/primary
Get nested menu structure: 
 https://your-site.com/wp-json/endpointy-menus/v1/menus/2?nested=true 
 https://your-site.com/wp-json/endpointy-menus/v1/locations/primary?nested=true
Use these URLs directly from your front-end application or API client.
<h3>Support the Developer</h3>
If you find this plugin useful, you can support the developer:
<ul>
<li>Website: https://gunjanjaswal.me</li>
<li>GitHub: https://github.com/gunjanjaswal/Endpointy-Menus</li>
<li>Ko-fi: https://ko-fi.com/gunjanjaswal</li>
</ul>
<h3>Contributing</h3>
Contributions, issues, and feature requests are welcome! 
GitHub: https://github.com/gunjanjaswal/Endpointy-Menus 
Issues: https://github.com/gunjanjaswal/Endpointy-Menus/issues

EndPointy Menus

Expose WordPress menus via a custom REST API endpoint for headless and external applications.

Md. Rakib Ullah

Running a Headless WordPress site often involves exposing the REST API. Headless REST API Security provides tools for administrators to control which endpoints are accessible to the public or external applications.
This plugin restricts public access to REST API endpoints by default and offers a settings interface to allow-list only the specific routes required by a frontend application (such as Next.js, Gatsby, or mobile apps).
<h3>Features</h3>
<ul>
<li>Access Control: Restrict default public access to REST API endpoints.</li>
<li>Route Allow-Listing: Specific API routes (e.g., <code>/wp/v2/posts</code>) can be enabled while others remain restricted.</li>
<li>API Key Authentication: Supports an <code>X-API-KEY</code> header for server-to-server or frontend requests.</li>
<li>Headless Redirect: Option to redirect users accessing the backend API URL to a specified frontend domain.</li>
<li>Admin Access: Logged-in Administrators and Editors retain access to the API to support the Block Editor (Gutenberg) functionality.</li>
<li>Plugin Support: Detects routes registered by third-party plugins for configuration.</li>
</ul>
<h3>Usage</h3>
<ol>
<li>Navigate to Settings > Headless Security in the WordPress dashboard.</li>
<li>Enable the Master Switch to activate the access restrictions.</li>
<li>Review the list of REST API routes and check the Allow box for endpoints the application requires.</li>
<li>Copy the generated API Key for use in application headers.</li>
<li>(Optional) Enter a Headless Frontend URL to configure redirects for visitors.</li>
</ol>

Headless REST API Security

Excellent plugin! Secures my headless WordPress API quickly and easily. Works perfectly with Next.js and mobile apps

Best Plugin for Securing Headless WordPress

Manage access to the WordPress REST API by restricting public endpoints, enabling specific route allow-listing, and handling API key authentication.

EndPointy Menus vs Headless REST API Security