Extending the REST module

Pro

You can change what the REST module exposes and how, with filters, without editing VX.

Filters

Filter	Use it to
vxframework/rest/can_read	Make the final decision on whether a viewer may read a resource, field or attachment
vxframework/rest/can_write	Make the final decision on a write (password fields can never be made writable)
vxframework/rest/field_value	Change one field's output value
vxframework/rest/resource_response	Change the whole vx object for an entry
vxframework/rest/schema	Add to the discovery schema
vxframework/rest/throttle	Rate-limit requests; see Errors, limits, and rate limiting
vxframework/rest/max_per_page	Change the 100-item page cap
vxframework/rest/user_role_exposed	Decide whether a user role is exposed

For example, to hide a field from everyone outside a membership plugin's paid tier:

add_filter( 'vxframework/rest/can_read', function ( bool $decision, array $context ) {
    if ( ( $context['field_key'] ?? '' ) === 'member_discount' && ! my_is_paid_member() ) {
        return false;
    }
    return $decision;
}, 10, 2 );

Note

When vxframework/rest/can_read, vxframework/rest/field_value or vxframework/rest/resource_response is in use, logged-in responses are no longer served from the shared cache, so one viewer's result is never shown to another. Public responses are still cached.

Discovery endpoint

Administrators can list everything the API exposes, with each field's type, tier and whether it's writable. It's useful for audits and for generating typed clients:

curl -u "admin:xxxx xxxx xxxx xxxx xxxx xxxx" "https://example.com/wp-json/vx-framework/v1/rest/schema"

It returns settings only, never content values, plus the output format's version, so a client can detect when the format changes.

Output format stability

The shape of the vx object is versioned (currently version 1). A change to it is treated as a breaking change and announced as one.

Technical details for LLMs

• Filter signatures: vxframework/rest/can_read (bool, array $context), vxframework/rest/can_write (bool, array $context), vxframework/rest/field_value (mixed, array $context), vxframework/rest/resource_response (array $payload, array $context), vxframework/rest/schema (array), vxframework/rest/max_per_page (int), vxframework/rest/user_role_exposed (bool, string $role). can_read / can_write context: type (resource | field), field_key (field decisions), entity_kind, entity_id, viewer_id.
• Field-type hooks (custom field classes): rest_value( array $field, $raw, Rest_Context $ctx ) returns a bespoke shape (null = generic); rest_bindable(): false keeps a data field off the REST surface while staying bindable in dynamic data (as area does).
• GET vx-framework/v1/rest/schema (admin): per resource gate state, endpoint, and fields { key, rest_key, type, node, tier, serialized, writable }, plus serializer version.