The Front Door You Forgot You Built: What These 5 REST API Hooks Actually Gate
The Problem Every WordPress install answers REST requests at /wp-json/ whether or not anyone deliberately built an API — and most sites have at least one custom field,…

Action Hook since 4.4.0
Fires when the REST API is initialized — register custom routes here
rest_api_init is the register_rest_route() equivalent of init — it only fires on REST requests, not every page load.
Only on requests that hit the REST API (/wp-json/...), not on regular front-end or admin page loads.
do_action( 'rest_api_init', WP_REST_Server $wp_rest_server );$wp_rest_server WP_REST_Server — The REST server instance handling the request.add_action( 'rest_api_init', function() {
register_rest_route( 'my-plugin/v1', '/books', [
'methods' => 'GET',
'callback' => 'my_plugin_get_books',
'permission_callback' => '__return_true',
] );
} );Register a custom read-only REST endpoint.

The Problem Every WordPress install answers REST requests at /wp-json/ whether or not anyone deliberately built an API — and most sites have at least one custom field,…
The REST server object doesn't exist yet on earlier hooks like init; rest_api_init is where WordPress builds it before dispatching the request.
Source: wp-includes/rest-api.php
One session: this hook, then each related_hooks entry. Walk it and tell us what to change.
rest_api_init → rest_prepare_post
Practice the rest_api_init WordPress action hook in our interactive sandbox — a VS Code-style editor with a step-by-step rest_api_init tutorial, add_action exercises, and instant feedback. No local WordPress install required.