Abilities API: Implement server-side registry with REST API endpoints #9410

gziolo · 2025-08-08T13:24:56Z

Trac ticket: https://core.trac.wordpress.org/ticket/64098

Part of Building Blocks for WordPress AI.

The Abilities API transforms WordPress from a collection of isolated functions into a unified, discoverable system. By creating a central registry of capabilities, it allows AI agents, automation tools, and developers to understand and interact with everything WordPress can do – from CLI commands and REST API endpoints to custom logic and plugin functions.

Full proposal at https://make.wordpress.org/ai/2025/07/17/abilities-api/.
Handbook page at https://make.wordpress.org/ai/handbook/projects/abilities-api/.
Documentation in https://github.com/WordPress/abilities-api/tree/trunk/docs.
Developed in https://github.com/WordPress/abilities-api.
Composer package: https://packagist.org/packages/wordpress/abilities-api.

This PR contains six incremental commits added at different times after syncing directly from https://github.com/WordPress/abilities-api without any modifications. The last update is from October 14th (9906821) and equals the state in the v0.3.0-rc release available for the Composer package.

TODO

Follow-ups

Include REST API endpoint for ability categories (code). PR ready at Add new REST API endpoint for Ability Categories gziolo/wordpress-develop#3.
The majority of the extender documentation should live in src/wp-includes/abilities-api.php rather than pointing to the classes which only core should be using.

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

github-actions · 2025-08-08T13:38:31Z

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

The Plugin and Theme Directories cannot be accessed within Playground.
All changes will be lost when closing a tab with a Playground instance.
All changes will be lost when refreshing the page.
A fresh instance is created each time the link below is clicked.
Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

gziolo · 2025-08-13T11:24:05Z

The changes landed in the Abilitis API plugin with WordPress/abilities-api#3.

gziolo · 2025-10-15T15:03:14Z

Two weeks ago, I synced changes from v0.2.0 in Abilities API repository with fd7412b.

Yesterday, I synced changes from v0.3.0-rc in Abilities API repository with 9906821.

…ries

Co-authored-by: Aaron Jorbin <[email protected]>

Co-authored-by: Timothy Jacobs <[email protected]>

…ility categories registry

Feature proposal at https://make.wordpress.org/ai/2025/07/17/abilities-api/. Project developed in https://github.com/WordPress/abilities-api. Introduces a new Abilities API that allows WordPress plugins and themes to register and execute custom abilities with built-in permission checking, input/output validation via JSON Schema, and REST API integration. ## Public Functions ### Ability Management - `wp_register_ability( string $name, array $args ): ?WP_Ability` - Registers a new ability (must be called on `wp_abilities_api_init` hook) - `wp_unregister_ability( string $name ): ?WP_Ability` - Unregisters an ability - `wp_has_ability( string $name ): bool` - Checks if an ability is registered - `wp_get_ability( string $name ): ?WP_Ability` - Retrieves a registered ability - `wp_get_abilities(): array` - Retrieves all registered abilities ### Ability Category Management - `wp_register_ability_category( string $slug, array $args ): ?WP_Ability_Category` - Registers an ability category (must be called on `wp_abilities_api_categories_init` hook) - `wp_unregister_ability_category( string $slug ): ?WP_Ability_Category` - Unregisters an ability category - `wp_has_ability_category( string $slug ): bool` - Checks if an ability category is registered - `wp_get_ability_category( string $slug ): ?WP_Ability_Category` - Retrieves a registered ability category - `wp_get_ability_categories(): array` - Retrieves all registered ability categories ## Public Classes - `WP_Ability` - Encapsulates ability properties and methods (execute, check_permission, validate_input, etc.) - `WP_Ability_Category` - Encapsulates ability category properties - `WP_Abilities_Registry` - Manages ability registration and lookup (private, accessed via functions) - `WP_Ability_Categories_Registry` - Manages ability category registration (private, accessed via functions) - `WP_REST_Abilities_V1_List_Controller` - REST controller for listing abilities - `WP_REST_Abilities_V1_Run_Controller` - REST controller for executing abilities ## REST API Endpoints ### Namespace: `wp-abilities/v1` #### List Abilities - `GET /wp-abilities/v1/abilities` - Retrieve all registered abilities - Query parameters: `page`, `per_page`, `category` #### Get Single Ability - `GET /wp-abilities/v1/abilities/(?P<name>[a-zA-Z0-9\-\/]+)` - Retrieve a specific ability by name #### Execute Ability - `GET|POST|DELETE /wp-abilities/v1/abilities/(?P<name>[a-zA-Z0-9\-\/]+)/run` - Execute an ability - Supports multiple HTTP methods based on ability annotations - Validates input against ability's input schema - Validates output against ability's output schema - Performs permission checks via ability's permission callback ## Hooks ### Actions - `wp_abilities_api_categories_init` - Fired when ability categories registry is initialized (register categories here) - `wp_abilities_api_init` - Fired when abilities registry is initialized (register abilities here) - `wp_before_execute_ability` - Fired before an ability gets executed, after input validation and permissions check - `wp_after_execute_ability` - Fires immediately after an ability finished executing ### Filters - `wp_register_ability_category_args` - Filters ability category arguments before registration - `wp_register_ability_args` - Filters ability arguments before registration Developed in #9410. Props gziolo, jorbin, justlevine, westonruter, jason_the_adams, flixos90, karmatosed, timothyblynjacobs. Fixes #64098. git-svn-id: https://develop.svn.wordpress.org/trunk@61032 602fd350-edb4-49c9-b593-d223f7449a82

github-actions · 2025-10-21T13:51:22Z

A commit was made that fixes the Trac ticket referenced in the description of this pull request.

SVN changeset: 61032
GitHub commit: cd95bd2

This PR will be closed, but please confirm the accuracy of this and reopen if there is more work to be done.

Feature proposal at https://make.wordpress.org/ai/2025/07/17/abilities-api/. Project developed in https://github.com/WordPress/abilities-api. Introduces a new Abilities API that allows WordPress plugins and themes to register and execute custom abilities with built-in permission checking, input/output validation via JSON Schema, and REST API integration. ## Public Functions ### Ability Management - `wp_register_ability( string $name, array $args ): ?WP_Ability` - Registers a new ability (must be called on `wp_abilities_api_init` hook) - `wp_unregister_ability( string $name ): ?WP_Ability` - Unregisters an ability - `wp_has_ability( string $name ): bool` - Checks if an ability is registered - `wp_get_ability( string $name ): ?WP_Ability` - Retrieves a registered ability - `wp_get_abilities(): array` - Retrieves all registered abilities ### Ability Category Management - `wp_register_ability_category( string $slug, array $args ): ?WP_Ability_Category` - Registers an ability category (must be called on `wp_abilities_api_categories_init` hook) - `wp_unregister_ability_category( string $slug ): ?WP_Ability_Category` - Unregisters an ability category - `wp_has_ability_category( string $slug ): bool` - Checks if an ability category is registered - `wp_get_ability_category( string $slug ): ?WP_Ability_Category` - Retrieves a registered ability category - `wp_get_ability_categories(): array` - Retrieves all registered ability categories ## Public Classes - `WP_Ability` - Encapsulates ability properties and methods (execute, check_permission, validate_input, etc.) - `WP_Ability_Category` - Encapsulates ability category properties - `WP_Abilities_Registry` - Manages ability registration and lookup (private, accessed via functions) - `WP_Ability_Categories_Registry` - Manages ability category registration (private, accessed via functions) - `WP_REST_Abilities_V1_List_Controller` - REST controller for listing abilities - `WP_REST_Abilities_V1_Run_Controller` - REST controller for executing abilities ## REST API Endpoints ### Namespace: `wp-abilities/v1` #### List Abilities - `GET /wp-abilities/v1/abilities` - Retrieve all registered abilities - Query parameters: `page`, `per_page`, `category` #### Get Single Ability - `GET /wp-abilities/v1/abilities/(?P<name>[a-zA-Z0-9\-\/]+)` - Retrieve a specific ability by name #### Execute Ability - `GET|POST|DELETE /wp-abilities/v1/abilities/(?P<name>[a-zA-Z0-9\-\/]+)/run` - Execute an ability - Supports multiple HTTP methods based on ability annotations - Validates input against ability's input schema - Validates output against ability's output schema - Performs permission checks via ability's permission callback ## Hooks ### Actions - `wp_abilities_api_categories_init` - Fired when ability categories registry is initialized (register categories here) - `wp_abilities_api_init` - Fired when abilities registry is initialized (register abilities here) - `wp_before_execute_ability` - Fired before an ability gets executed, after input validation and permissions check - `wp_after_execute_ability` - Fires immediately after an ability finished executing ### Filters - `wp_register_ability_category_args` - Filters ability category arguments before registration - `wp_register_ability_args` - Filters ability arguments before registration Developed in WordPress/wordpress-develop#9410. Props gziolo, jorbin, justlevine, westonruter, jason_the_adams, flixos90, karmatosed, timothyblynjacobs. Fixes #64098. Built from https://develop.svn.wordpress.org/trunk@61032 git-svn-id: http://core.svn.wordpress.org/trunk@60368 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Feature proposal at https://make.wordpress.org/ai/2025/07/17/abilities-api/. Project developed in https://github.com/WordPress/abilities-api. Introduces a new Abilities API that allows WordPress plugins and themes to register and execute custom abilities with built-in permission checking, input/output validation via JSON Schema, and REST API integration. ## Public Functions ### Ability Management - `wp_register_ability( string $name, array $args ): ?WP_Ability` - Registers a new ability (must be called on `wp_abilities_api_init` hook) - `wp_unregister_ability( string $name ): ?WP_Ability` - Unregisters an ability - `wp_has_ability( string $name ): bool` - Checks if an ability is registered - `wp_get_ability( string $name ): ?WP_Ability` - Retrieves a registered ability - `wp_get_abilities(): array` - Retrieves all registered abilities ### Ability Category Management - `wp_register_ability_category( string $slug, array $args ): ?WP_Ability_Category` - Registers an ability category (must be called on `wp_abilities_api_categories_init` hook) - `wp_unregister_ability_category( string $slug ): ?WP_Ability_Category` - Unregisters an ability category - `wp_has_ability_category( string $slug ): bool` - Checks if an ability category is registered - `wp_get_ability_category( string $slug ): ?WP_Ability_Category` - Retrieves a registered ability category - `wp_get_ability_categories(): array` - Retrieves all registered ability categories ## Public Classes - `WP_Ability` - Encapsulates ability properties and methods (execute, check_permission, validate_input, etc.) - `WP_Ability_Category` - Encapsulates ability category properties - `WP_Abilities_Registry` - Manages ability registration and lookup (private, accessed via functions) - `WP_Ability_Categories_Registry` - Manages ability category registration (private, accessed via functions) - `WP_REST_Abilities_V1_List_Controller` - REST controller for listing abilities - `WP_REST_Abilities_V1_Run_Controller` - REST controller for executing abilities ## REST API Endpoints ### Namespace: `wp-abilities/v1` #### List Abilities - `GET /wp-abilities/v1/abilities` - Retrieve all registered abilities - Query parameters: `page`, `per_page`, `category` #### Get Single Ability - `GET /wp-abilities/v1/abilities/(?P<name>[a-zA-Z0-9\-\/]+)` - Retrieve a specific ability by name #### Execute Ability - `GET|POST|DELETE /wp-abilities/v1/abilities/(?P<name>[a-zA-Z0-9\-\/]+)/run` - Execute an ability - Supports multiple HTTP methods based on ability annotations - Validates input against ability's input schema - Validates output against ability's output schema - Performs permission checks via ability's permission callback ## Hooks ### Actions - `wp_abilities_api_categories_init` - Fired when ability categories registry is initialized (register categories here) - `wp_abilities_api_init` - Fired when abilities registry is initialized (register abilities here) - `wp_before_execute_ability` - Fired before an ability gets executed, after input validation and permissions check - `wp_after_execute_ability` - Fires immediately after an ability finished executing ### Filters - `wp_register_ability_category_args` - Filters ability category arguments before registration - `wp_register_ability_args` - Filters ability arguments before registration Developed in WordPress/wordpress-develop#9410. Props gziolo, jorbin, justlevine, westonruter, jason_the_adams, flixos90, karmatosed, timothyblynjacobs. Fixes #64098. Built from https://develop.svn.wordpress.org/trunk@61032 git-svn-id: https://core.svn.wordpress.org/trunk@60368 1a063a9b-81f0-0310-95a4-ce76da25c4cd

gziolo · 2025-10-21T14:34:09Z

I opened a follow up with the missing REST API controller for Ability Categories:

Abilities API: Add Ability Categories REST API controller #10380

This was discussed in #9410 and decided to defer until after beta1. Fleshing out the phpdocs for the extender functions in https://core.trac.wordpress.org/browser/trunk/src/wp-includes/abilities-api.php should make it easier for people working with the abilities API Developed in #10412. Follw-up [61032]. Props jorbin, gziolo, mukesh27, jason_the_adams, westonruter. Fixes #64134. git-svn-id: https://develop.svn.wordpress.org/trunk@61067 602fd350-edb4-49c9-b593-d223f7449a82

This was discussed in WordPress/wordpress-develop#9410 and decided to defer until after beta1. Fleshing out the phpdocs for the extender functions in https://core.trac.wordpress.org/browser/trunk/src/wp-includes/abilities-api.php should make it easier for people working with the abilities API Developed in WordPress/wordpress-develop#10412. Follw-up [61032]. Props jorbin, gziolo, mukesh27, jason_the_adams, westonruter. Fixes #64134. Built from https://develop.svn.wordpress.org/trunk@61067 git-svn-id: http://core.svn.wordpress.org/trunk@60403 1a063a9b-81f0-0310-95a4-ce76da25c4cd

This was discussed in WordPress/wordpress-develop#9410 and decided to defer until after beta1. Fleshing out the phpdocs for the extender functions in https://core.trac.wordpress.org/browser/trunk/src/wp-includes/abilities-api.php should make it easier for people working with the abilities API Developed in WordPress/wordpress-develop#10412. Follw-up [61032]. Props jorbin, gziolo, mukesh27, jason_the_adams, westonruter. Fixes #64134. Built from https://develop.svn.wordpress.org/trunk@61067 git-svn-id: https://core.svn.wordpress.org/trunk@60403 1a063a9b-81f0-0310-95a4-ce76da25c4cd

gziolo self-assigned this Aug 8, 2025

gziolo mentioned this pull request Aug 8, 2025

Implement server-side registry for Abilities API WordPress/abilities-api#3

Merged

gziolo force-pushed the try/abilities-api branch from ea5e7bc to 9fe651a Compare August 11, 2025 12:16

gziolo mentioned this pull request Aug 14, 2025

Scaffold repository tooling WordPress/abilities-api#13

Closed

9 tasks

gziolo force-pushed the try/abilities-api branch 2 times, most recently from f2a5ae1 to f825e40 Compare August 18, 2025 10:33

gziolo mentioned this pull request Aug 18, 2025

Chore: Fix coding standard issues reported on wordpress-develop WordPress/abilities-api#25

Merged

gziolo force-pushed the try/abilities-api branch from f825e40 to d5bcfb6 Compare August 26, 2025 07:48

gziolo mentioned this pull request Aug 26, 2025

Remove ignoreErrors from PHPStan WordPress/abilities-api#40

Merged

gziolo force-pushed the try/abilities-api branch from b34a566 to 8f4910c Compare August 27, 2025 12:17

gziolo mentioned this pull request Aug 27, 2025

Add code quality improvements to code comments WordPress/abilities-api#47

Merged

gziolo force-pushed the try/abilities-api branch from 8f4910c to 42e2f3b Compare August 27, 2025 15:54

gziolo force-pushed the try/abilities-api branch from 42e2f3b to 1711c00 Compare September 8, 2025 11:46

gziolo mentioned this pull request Sep 8, 2025

Refactor the usage of $properties param to $args to align with WordPress usage WordPress/abilities-api#59

Merged

gziolo force-pushed the try/abilities-api branch 2 times, most recently from 0c1ee5e to 9e2c2ff Compare September 29, 2025 12:52

gziolo mentioned this pull request Sep 29, 2025

Prepare the branch for v0.2.0 release WordPress/abilities-api#90

Merged

gziolo force-pushed the try/abilities-api branch 2 times, most recently from 3bc83b6 to 8362bcb Compare October 1, 2025 07:54

gziolo mentioned this pull request Oct 10, 2025

Feature: add categories system WordPress/abilities-api#102

Merged

gziolo force-pushed the try/abilities-api branch 2 times, most recently from df786b2 to d7b4f3d Compare October 14, 2025 14:14

gziolo mentioned this pull request Oct 14, 2025

Update version to 0.3.0 in preparation to Composer package release WordPress/abilities-api#116

Merged

gziolo force-pushed the try/abilities-api branch from d7b4f3d to 9906821 Compare October 14, 2025 14:19

gziolo changed the title ~~Abilities API: Implement server-side registry~~ Abilities API: Implement server-side registry with REST API endpoints Oct 15, 2025

gziolo force-pushed the try/abilities-api branch 2 times, most recently from f9a8f24 to d35222f Compare October 15, 2025 20:28

gziolo and others added 10 commits October 21, 2025 14:37

Improve support for annotations, including DELETE handling in REST API

de07c8c

Fix bug in the permission check for ability in REST API run controller

1e54797

Improve handling for init hooks related to abilities and their catego…

57d8eda

…ries

Apply suggestions from code review

6cb5d7c

Co-authored-by: Aaron Jorbin <[email protected]>

Update src/wp-includes/abilities-api/class-wp-ability.php

7f68dd9

Co-authored-by: Aaron Jorbin <[email protected]>

Apply suggestions from code review

b36ea85

Co-authored-by: Timothy Jacobs <[email protected]>

Rename REST routes and controllers

e124094

Enforce init hook before using ability related registries

1dec6a7

Increase testing code coverage for required init action check in ab…

2dbde17

…ility categories registry

Promote validate_input to public method and refactor usage

bcc6ff9

gziolo force-pushed the try/abilities-api branch 2 times, most recently from 9939e36 to 3d2c27a Compare October 21, 2025 12:50

Fix test for expected routes in REST API schema

88b4a6f

gziolo force-pushed the try/abilities-api branch from 3d2c27a to 88b4a6f Compare October 21, 2025 13:33

github-actions bot closed this Oct 21, 2025

gziolo mentioned this pull request Oct 21, 2025

Abilities API: Add Ability Categories REST API controller #10380

Closed

gziolo deleted the try/abilities-api branch October 22, 2025 14:01

jonathanbossenger mentioned this pull request Oct 30, 2025

What's new for developers? (November 2025) WordPress/developer-blog-content#419

Closed

gziolo mentioned this pull request Nov 4, 2025

Abilities API: Use stricter doing_action check when registering #10452

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Abilities API: Implement server-side registry with REST API endpoints #9410

Abilities API: Implement server-side registry with REST API endpoints #9410

Uh oh!

gziolo commented Aug 8, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Aug 8, 2025

Uh oh!

gziolo commented Aug 13, 2025

Uh oh!

gziolo commented Oct 15, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Oct 21, 2025

Uh oh!

gziolo commented Oct 21, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

Abilities API: Implement server-side registry with REST API endpoints #9410

Abilities API: Implement server-side registry with REST API endpoints #9410

Uh oh!

Conversation

gziolo commented Aug 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

TODO

Follow-ups

Uh oh!

github-actions bot commented Aug 8, 2025

Test using WordPress Playground

Some things to be aware of

Uh oh!

gziolo commented Aug 13, 2025

Uh oh!

gziolo commented Oct 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Oct 21, 2025

Uh oh!

gziolo commented Oct 21, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

gziolo commented Aug 8, 2025 •

edited

Loading

gziolo commented Oct 15, 2025 •

edited

Loading