10.57: the REST API is back, behind a switch
10.56 removed three REST routes that an integration depended on. They are back in 10.57, off by default, with a safer contract. Here is what happened and how to turn them on.
10.57 is a short release, and most of it fixes a mistake I made in 10.56.
What went wrong in 10.56
The 10.56 release post had this line near the bottom:
Three REST routes nothing called,
POST snippets,snippets/createandsnippets/update, were removed.
“Nothing called” was true for FluentSnippets itself. The editor saves through admin-ajax and never used those routes. But I checked that against this plugin’s own code and nothing else, and an integration outside the plugin did call them. When its users updated to 10.56, adding and editing snippets from that tool stopped working.
Removing a public API route is a breaking change, and it should have been announced as one. It was announced as a cleanup. I am sorry to the people who lost an afternoon to it.
What 10.57 does
The three routes are back, and the request format they accepted before 10.56 still works. If your integration broke, it will work again once you do one thing.
The routes are now off until you turn them on. Go to FluentSnippets → Settings, switch on
Enable REST API to manage snippets, and click Save Settings. If you manage sites through
wp-config.php, this does the same and locks the switch:
define( 'FLUENT_SNIPPETS_REST_AUTHORING', true );Why off by default? WordPress’s own REST API lets an administrator’s Application Password do a lot, but it never lets it upload arbitrary PHP to the site. These routes do exactly that. Turning them on changes what a leaked Application Password can do, and I think a site owner should make that choice knowingly, not inherit it in an update. For the same reason, the switch can only be changed on the Settings screen. An Application Password cannot turn it on for itself.
Reading, activating, deactivating and deleting snippets over REST work as before and are not affected by the switch.
A safer contract for integrations
While the routes were apart, they got the fixes they always needed:
- An update changes only what you send. Before, a partial update could reset fields you left out, so editing a snippet’s code could also unpublish it. Now every field you do not send keeps its value.
- No silent overwrites. Send the
code_hashyou last read asexpected_hash. If someone saved the snippet since, nothing is written and you get a 409 with the current hash. - Replies return the saved snippet, read back from disk, with its new
code_hash. - Clear refusals. Each refusal says why: not signed in, the switch is off,
DISALLOW_FILE_MODSis set, or the account is missing a permission. - An audit hook.
fluent_snippets/rest_snippet_writtenfires on every add and edit, with the user and the Application Password that made it, so a log can tell your deploy key apart from you in a browser.
The REST API documentation has every endpoint, field and error, with examples.
The rest
- Fixed the editor’s line-wrap setting turning itself off whenever the snippet index was rebuilt.
- Better translations: sentences are no longer split into pieces, and every string with a placeholder now carries a note for translators.
- Updated the libraries the admin screen is built on (Vue, Element Plus and CodeMirror).
Getting it
Update from Plugins → Updates in wp-admin, or download it from the WordPress.org directory. Nothing in this release changes the snippet file format.
If you maintain an integration that uses these routes, the REST API documentation is the place to start. If something does not behave the way it reads there, open an issue on GitHub and we will look at it.