
Security News
CVE Volume Surges Past 48,000 in 2025 as WordPress Plugin Ecosystem Drives Growth
CVE disclosures hit a record 48,185 in 2025, driven largely by vulnerabilities in third-party WordPress plugins.
@wordpress/api-fetch
Advanced tools
Utility to make WordPress REST API requests. It's a wrapper around window.fetch.
Install the module
npm install @wordpress/api-fetch --save
This package assumes that your code will run in an ES2015+ environment. If you're using an environment that has limited or no support for ES2015+ such as lower versions of IE then using core-js or @babel/polyfill will add support for these methods. Learn more about it in Babel docs.
import apiFetch from '@wordpress/api-fetch';
// GET
apiFetch( { path: '/wp/v2/posts' } ).then( posts => {
console.log( posts );
} );
// POST
apiFetch( {
path: '/wp/v2/posts/1',
method: 'POST',
data: { title: 'New Post Title' },
} ).then( res => {
console.log( res );
} );
apiFetch supports and passes through all options of the fetch global.
Additionally, the following options are available:
path (string)Shorthand to be used in place of url, appended to the REST API root URL for the current site.
url (string)Absolute URL to the endpoint from which to fetch.
parse (boolean, default true)Unlike fetch, the Promise return value of apiFetch will resolve to the parsed JSON result. Disable this behavior by passing parse as false.
data (object)Shorthand to be used in place of body, accepts an object value to be stringified to JSON.
the api-fetch package supports middlewares. Middlewares are functions you can use to wrap the apiFetch calls to perform any pre/post process to the API requests.
Example
import apiFetch from '@wordpress/api-fetch';
apiFetch.use( ( options, next ) => {
const start = Date.now();
const result = next( options );
result.then( () => {
console.log( 'The request took ' + Date.now() - start );
} );
return result;
} );
The api-fetch package provides built-in middlewares you can use to provide a nonce and a custom rootURL.
Nonce middleware
import apiFetch from '@wordpress/api-fetch';
const nonce = "nonce value";
apiFetch.use( apiFetch.createNonceMiddleware( nonce ) );
The function returned by createNonceMiddleware includes a nonce property corresponding to the actively used nonce. You may also assign to this property if you have a fresh nonce value to use.
Root URL middleware
import apiFetch from '@wordpress/api-fetch';
const rootURL = "http://my-wordpress-site/wp-json/";
apiFetch.use( apiFetch.createRootURLMiddleware( rootURL ) );
The api-fetch package uses window.fetch for making the requests but you can use a custom fetch handler by using the setFetchHandler method. The custom fetch handler will receive the options passed to the apiFetch calls.
Example
The example below uses a custom fetch handler for making all the requests with axios.
import apiFetch from '@wordpress/api-fetch';
import axios from 'axios';
apiFetch.setFetchHandler( ( options ) => {
const { url, path, data, method } = options;
return axios( {
url: url || path,
method,
data,
} );
} );

FAQs
Utility to make WordPress REST API requests.
The npm package @wordpress/api-fetch receives a total of 87,197 weekly downloads. As such, @wordpress/api-fetch popularity was classified as popular.
We found that @wordpress/api-fetch demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 23 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
CVE disclosures hit a record 48,185 in 2025, driven largely by vulnerabilities in third-party WordPress plugins.

Security News
Socket CEO Feross Aboukhadijeh joins Insecure Agents to discuss CVE remediation and why supply chain attacks require a different security approach.

Security News
Tailwind Labs laid off 75% of its engineering team after revenue dropped 80%, as LLMs redirect traffic away from documentation where developers discover paid products.