WP REST API – Hiding Endpoints

As of WordPress 4.4 the first part of the WP-API project has been integrated into WP Core, specifically in /wp-includes/rest-api. There are a few filters and tricks that are not brought to light in the WordPress 4.4 Release Notes

Disable default routes to standard WP Objects/Information

/*
 * WordPress 4.4/4.5/4.6 Addition of the new REST API
 * Disable default routes (not our custom ones)
 */
remove_action( 'rest_api_init', 'create_initial_rest_routes', 0 );

Customizing {your-site}/wp-json

Controlling Endpoints Shown

/*
 * WordPress 4.4/4.5/4.6 Addition of the new REST API
 * Hide these from being visible on /wp-json
 */
add_filter( 'rest_route_data', function ($routes) {
 $hiddenRoutes = [
 '/{your-plugin-or-theme-base}/{endpoint-version}/{endpoint}',
 '/{your-plugin-or-theme-base}/{endpoint-version}/{endpoint}',
 ];
 foreach($routes as $key => $route) {
 if(in_array($key, $hiddenRoutes)){
 unset($routes[$key]);
 }
 }
 return $routes;
});

Customizing the descriptions of your endpoints

/*
 * WordPress 4.4/4.5/4.6 Addition of the new REST API
 *
 */
add_filter( 'rest_endpoints_description', function ($data) {
 return $data;
});