API status: tested and working — 3 November 2026

The WordPress REST API posting route was tested live on 3 November 2026 and works. Test results, with no password values shown here: POST https://worldpulsewire.com/wp-json/wp/v2/posts as wpw-author (Author) with a fresh Application Password returned 201 Created and created a draft post with the exact title ‘API Test Draft — Delete Me’, status draft, author id 2, and category World (id 2). That draft was verified in Posts > Drafts, then moved to Trash and permanently deleted, so no test post remains published or in drafts. GET https://worldpulsewire.com/wp-json/wp/v2/users/me as wpw-editor (Editor) with a fresh Application Password returned 200 OK for user id 3. GET https://worldpulsewire.com/wp-json/wp/v2/users/me as wpw-author2 (Author) with a fresh Application Password returned 200 OK for user id 4. No test post was published at any stage.

Base URL

https://worldpulsewire.com/wp-json/wp/v2/

Your own user and your own Application Password

Each admin who posts gets their OWN user account and their OWN Application Password. Do not share one account or one key between admins. Application Passwords are for API use only and cannot be used to sign in at wp-login.php.

Accounts ready on this site: wpw-author (Author), wpw-author2 (Author), wpw-author3 (Author), wpw-editor (Editor), wpw-editor2 (Editor). The wpw-author, wpw-editor and wpw-author2 keys were tested on 3 November 2026. wpw-author3 and wpw-editor2 do not yet have an Application Password: the site admin must create one for them at first use, in Users > Edit User > Application Passwords, and save it at that moment (see below).

Save the key at creation — it is shown only once

WordPress shows an Application Password value only once, at the moment it is created. It cannot be retrieved later from the Users screen. Save it securely at that exact moment, before leaving the page. If a key is lost, forgotten, or was not saved, it cannot be recovered: revoke that key in Users > Edit User > Application Passwords and create a fresh one, then save the fresh value immediately and test it with a draft post (see below). Do not put a password value in a report, chat, or public page. Note: in the 3 November 2026 test session, the Revoke buttons on the user profile did not remove the old, unused keys from the first creation round in this browser, even after repeated clicks and a wait. Those old keys were never used (Last Used was blank) and their values were never saved, but the site admin should still revoke any unused Application Passwords in a normal browser session when possible.

Draft-first workflow — follow this order

  1. Post as a draft: POST https://worldpulsewire.com/wp-json/wp/v2/posts with status draft, a title, content, and a category id from GET https://worldpulsewire.com/wp-json/wp/v2/categories. Do not use status publish for a first submission.
  2. Editor reviews: an Editor opens the draft in Posts > Drafts, checks the wording, headline, category, Key Points and Source + Time footer, and edits it if needed.
  3. Publish only after review: the Editor then publishes the post, either in WordPress admin or by POST https://worldpulsewire.com/wp-json/wp/v2/posts/{id} with status publish. A test post must never be published: delete it from Drafts and then permanently from Trash.

Authentication

Use HTTP Basic Authentication with the username and that account’s Application Password, with spaces removed from the password. Example header, with placeholders only: Authorization: Basic base64(username:application-password)

Endpoints

  • GET https://worldpulsewire.com/wp-json/wp/v2/posts — List published posts (public).
  • GET https://worldpulsewire.com/wp-json/wp/v2/posts/{id} — Get one post.
  • GET https://worldpulsewire.com/wp-json/wp/v2/categories — List categories, including World, Politics, Business, Technology, Sports, Middle East and Analysis. Use the id from this response when posting. Confirmed on 3 November 2026: World 2, Politics 3, Business 4, Technology 5, Sports 6, Middle East 7, Analysis 8, Uncategorized 1.
  • POST https://worldpulsewire.com/wp-json/wp/v2/posts — Create a post (authenticated).
  • POST https://worldpulsewire.com/wp-json/wp/v2/posts/{id} — Update a post (authenticated).
  • DELETE https://worldpulsewire.com/wp-json/wp/v2/posts/{id} — Move a post to Trash (authenticated).

Create a draft example

POST https://worldpulsewire.com/wp-json/wp/v2/posts with a JSON body such as: title, content, status draft, categories (array of category ids), and excerpt. Every article should include a Key Points section and a Source + Time footer, as used in the starter articles.

Example request, with placeholders only, not a real password: curl -u wpw-author:YOUR_APPLICATION_PASSWORD -H Content-Type: application/json -d ‘{“title”:”Example title”,”content”:”Example article text with Key Points and a Source + Time footer.”,”status”:”draft”,”categories”:[2]}’ https://worldpulsewire.com/wp-json/wp/v2/posts

Rules

  • Draft first for review, then Editor publishes. No test post is published.
  • Use original wording. Do not copy other news reports.
  • Keep advertisements as labelled placeholders only. No real advertising code and no pop-ups.

What an admin needs to start posting

  1. Their own WordPress user account on this site, with Author or Editor role (see the accounts list above).
  2. Their own Application Password, created in Users > Edit User > Application Passwords and saved securely at the moment it is shown, because it cannot be retrieved later.
  3. The base URL https://worldpulsewire.com/wp-json/wp/v2/ and the category id from GET categories.
  4. A first test as a draft only, verified in Posts > Drafts, then deleted, before posting a real article.