Exposing content

Pro

A field value appears in the REST API only when three switches all allow it.

1. The post type or taxonomy is in the REST API

On the post type's or taxonomy's REST API tab, Show in REST API must be on. It's WordPress's own switch, and the block editor needs it too, so it's usually on already. If it's off, nothing about that post type is served, VX fields included.

Users are different: they're off until you opt in specific roles (see below).

2. The fieldset's default access

Each fieldset's General tab has REST API default field access. It applies to every field in the fieldset that's set to inherit it, and it starts at Private.

3. The field's access

Each field's REST API tab has Access: Inherit from fieldset, Public, Authenticated or Private. A field's own setting always beats the fieldset default. The same tab has REST key, which publishes the value under a different name than the field key.

See Access tiers for exactly who sees what.

Exposing users

User fields are never served to anonymous visitors. To serve them at all, open VX → REST API, choose User settings (top right), and opt in the roles whose profiles apps may read. User fields are served to logged-in viewers at most, even when marked Public.

Check what you exposed

VX → REST API shows the result:

• Overview lists each exposed post type, taxonomy and user role as a card, with how many fields are public, authenticated-only and private.
• Preview fetches a real response as a Public visitor, an Authenticated user, or a user you choose.

Warning

When you're signed in as an administrator, you see every field, because anyone who can edit an entry can read all its fields. Always check what visitors get with Preview → Public, or a request from a logged-out browser.

What's never exposed

• Password fields, anywhere, including inside Groups and Repeaters.
• Layout fields and Area shapes.
• Option pages. Read those in PHP and publish what you need yourself.
• The raw meta values behind VX fields, for anyone below editor level. The vx object is the supported way to read them.

Technical details for LLMs

• Gates: resource (show_in_rest for post types/taxonomies; per-role opt-in for users, vxframework/rest/user_role_exposed) → fieldset rest.expose (public | authenticated | private, default private) → field rest.access (inherit | public | authenticated | private, default inherit).
• Aliases: rest.rest_key (≤ 64) replaces the key in reads, writes and error paths.
• Discovery (admin): GET vx-framework/v1/rest/schema lists every resource's gate state and per-field { key, rest_key, type, node, tier, serialized, writable }. The dashboard preview proxy POST vx-framework/v1/rest/preview needs manage_options, allows only GET /wp/v2/…, and never elevates.
• Settings are saved in Free (exported and imported with the fieldset) and take effect only when the Pro module is active.