
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
@wordpress/api-fetch
Advanced tools
Utility to make WordPress REST API requests. It's a wrapper around window.fetch.
Install the module
npm install @wordpress/api-fetch --save
This package assumes that your code will run in an ES2015+ environment. If you're using an environment that has limited or no support for ES2015+ such as lower versions of IE then using core-js or @babel/polyfill will add support for these methods. Learn more about it in Babel docs.
import apiFetch from '@wordpress/api-fetch';
// GET
apiFetch( { path: '/wp/v2/posts' } ).then( posts => {
console.log( posts );
} );
// POST
apiFetch( {
path: '/wp/v2/posts/1',
method: 'POST',
data: { title: 'New Post Title' },
} ).then( res => {
console.log( res );
} );
apiFetch supports and passes through all options of the fetch global.
Additionally, the following options are available:
path (string)Shorthand to be used in place of url, appended to the REST API root URL for the current site.
url (string)Absolute URL to the endpoint from which to fetch.
parse (boolean, default true)Unlike fetch, the Promise return value of apiFetch will resolve to the parsed JSON result. Disable this behavior by passing parse as false.
data (object)Shorthand to be used in place of body, accepts an object value to be stringified to JSON.
the api-fetch package supports middlewares. Middlewares are functions you can use to wrap the apiFetch calls to perform any pre/post process to the API requests.
Example
import apiFetch from '@wordpress/api-fetch';
apiFetch.use( ( options, next ) => {
const start = Date.now();
const result = next( options );
result.then( () => {
console.log( 'The request took ' + Date.now() - start );
} );
return result;
} );
The api-fetch package provides built-in middlewares you can use to provide a nonce and a custom rootURL.
Nonce middleware
import apiFetch from '@wordpress/api-fetch';
const nonce = "nonce value";
apiFetch.use( apiFetch.createNonceMiddleware( nonce ) );
The function returned by createNonceMiddleware includes a nonce property corresponding to the actively used nonce. You may also assign to this property if you have a fresh nonce value to use.
Root URL middleware
import apiFetch from '@wordpress/api-fetch';
const rootURL = "http://my-wordpress-site/wp-json/";
apiFetch.use( apiFetch.createRootURLMiddleware( rootURL ) );
The api-fetch package uses window.fetch for making the requests but you can use a custom fetch handler by using the setFetchHandler method. The custom fetch handler will receive the options passed to the apiFetch calls.
Example
The example below uses a custom fetch handler for making all the requests with axios.
import apiFetch from '@wordpress/api-fetch';
import axios from 'axios';
apiFetch.setFetchHandler( ( options ) => {
const { url, path, data, method } = options;
return axios( {
url: url || path,
method,
data,
} );
} );

FAQs
Utility to make WordPress REST API requests.
The npm package @wordpress/api-fetch receives a total of 44,401 weekly downloads. As such, @wordpress/api-fetch popularity was classified as popular.
We found that @wordpress/api-fetch demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 23 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.