# Call your site's own REST routes

> Let your AI agent call the REST routes your site adds, in namespaces an administrator approves. Set up wp_call_site_rest_route and read its refusal codes.

- Canonical: <https://royalplugins.com/support/royal-mcp-pro/site-rest-routes/>
- HTML version: <https://royalplugins.com/support/royal-mcp-pro/site-rest-routes/>

---

Your site's plugins and custom code can add their own REST routes. With `wp_call_site_rest_route`, your AI agent can call those routes in the namespaces an administrator approves. The tool stays off until you approve one.

What you need

Royal MCP Pro 1.0.17 or later, an active license, and an AI agent connected as an administrator.

## Turn it on

#### Open Plugin Abilities

Go to **Royal MCP Pro → Plugin Abilities** and scroll to **Site REST routes**.

#### Add the namespace

Type the exact namespace, such as `vendor/v1`. A namespace is the part of the route that comes straight after `/wp-json/`. You can approve up to 50.

#### Choose the methods

GET is always allowed for an approved namespace. Tick `POST`, `PUT`, `PATCH` or `DELETE` only for the namespaces where your AI agent should send those calls.

#### Save

Click **Save**. To remove a namespace later, clear its row and save again.

## Call a route

Ask in plain words, such as "call the items route on my site", or name the tool and its arguments:

| Argument | What it takes |
| --- | --- |
| `path` (required) | The route, such as `/vendor/v1/items`. No query string: send those values in `query`. |
| `method` | `GET`, `POST`, `PUT`, `PATCH` or `DELETE`, in capitals. Defaults to `GET`. |
| `query` | Query parameters as an object, up to 8 KB. |
| `body` | A JSON body as an object, up to 256 KB. Not used with GET. |

The reply gives the route's status code and its data, up to 256 KB. Credentials in the reply are hidden before your AI agent sees it.

## What stays protected

- **The route's own permission check still runs.** The call runs as the signed-in administrator, so a route that refuses that user stays refused.
- **Administrators only.** Other roles can't use the tool, even with a namespace approved.
- **Read-only and drafts-only.** The whole tool is off in these modes and on connections set to them, GET included, because a GET route's code can still write.
- **Sites managed by Royally.** Only Royally's connection can use the tool, and a person approves each call there.
- **Routes that are never allowed.** WordPress core, batch, Royal MCP and sign-in routes stay out of reach, even if you list them.
- **Activity log.** Each call is recorded with its route, method and status. What was sent is not stored.

There is no undo

A call runs your route's own code, so Royal MCP Pro can't reverse what it does. Allow write methods only for routes you trust, and remember that a GET route can change data if its code does.

## Common surprises

**A route with a sign-in word in its address is refused.** Words such as `login`, `password` and `token` count as sign-in routes, even inside a namespace you approved. The same check covers the data you send, so a field named `password` or a short value like `action=login` is refused too.

**The call came back as an empty HTTP 500.** The route ended the request itself, for example with `wp_send_json()` or `exit`. It may have done its work first, and the Activity log still has the call. Return a `WP_REST_Response` from the route instead.

**A redirect isn't followed.** The reply says the route asked to redirect and gives the address.

**Text the route prints is dropped.** Only the data the route returns reaches your AI agent.

**A longer namespace needs its own approval.** Approving `vendor/v1` doesn't cover a separately registered `vendor/v1/internal`.

## What each refusal means

| Code | What to do |
| --- | --- |
| `site_rest_off` | No namespace is approved yet. Follow the steps above. |
| `namespace_not_approved` | Add the namespace in Site REST routes, spelled exactly as the route registers it. |
| `method_not_allowed` | Tick that method for the namespace, or check that the method is in capitals. |
| `route_never_allowed` | This route can't be called with this tool, whatever the list says. |
| `path_not_allowed` | Send a plain route such as `/vendor/v1/items`, with no encoding or query string. |
| `invalid_args` | Check the arguments: `query` and `body` are objects, GET takes no body, and names can't start with an underscore. |
| `insufficient_caps` | Connect your AI agent as an administrator. |
| `safety_mode` | Turn off read-only or drafts-only mode for the site, then try again. |
| `managed_by_royally` | Make the call through Royally. |
| `request_too_large` | Send less: `query` is limited to 8 KB and `body` to 256 KB. |
| `response_too_large` | The route ran, but its reply was over 256 KB. Ask the route for less. |
| `route_error` | The route answered with an error status. The reply includes its message. |
| `route_failed` | The route stopped while running. Check what it changed before you try again. |
| `response_unreadable` | The route ran, but its reply could not be returned. Check what it changed. |
| `nested_route_refused` | The route called another route that isn't approved. It appears as the route's own error. |

## Still stuck? Two-step support path

### Step 1: Start with the troubleshooting guide

[**Royal MCP Pro Troubleshooting: Start Here**](https://royalplugins.com/support/royal-mcp-pro/troubleshooting-start-here/) covers connection and license problems that can look like a route problem.

### Step 2: Email priority support

Email priority support from your purchase email address at **[support@royalplugins.com](mailto:support@royalplugins.com)**.

What to include in your email

- **The refusal code** and the full message from the reply
- **The path and method** you called
- **The namespace and methods** approved in Site REST routes
- **Royal MCP Pro version**

[← Builder Session Detected](https://royalplugins.com/support/royal-mcp-pro/builder-session-detected-force-override/)
[Support Overview →](https://royalplugins.com/support/royal-mcp-pro/)