Call your site's own REST routes
Your site's plugins and custom code can add their own REST routes. With wp_call_site_rest_route, your AI agent can call those routes in the namespaces an administrator approves. The tool stays off until you approve one.
Royal MCP Pro 1.0.17 or later, an active license, and an AI agent connected as an administrator.
Turn it on
Open Plugin Abilities
Go to Royal MCP Pro → Plugin Abilities and scroll to Site REST routes.
Add the namespace
Type the exact namespace, such as vendor/v1. A namespace is the part of the route that comes straight after /wp-json/. You can approve up to 50.
Choose the methods
GET is always allowed for an approved namespace. Tick POST, PUT, PATCH or DELETE only for the namespaces where your AI agent should send those calls.
Save
Click Save. To remove a namespace later, clear its row and save again.
Call a route
Ask in plain words, such as "call the items route on my site", or name the tool and its arguments:
| Argument | What it takes |
|---|---|
path (required) | The route, such as /vendor/v1/items. No query string: send those values in query. |
method | GET, POST, PUT, PATCH or DELETE, in capitals. Defaults to GET. |
query | Query parameters as an object, up to 8 KB. |
body | A JSON body as an object, up to 256 KB. Not used with GET. |
The reply gives the route's status code and its data, up to 256 KB. Credentials in the reply are hidden before your AI agent sees it.
What stays protected
- The route's own permission check still runs. The call runs as the signed-in administrator, so a route that refuses that user stays refused.
- Administrators only. Other roles can't use the tool, even with a namespace approved.
- Read-only and drafts-only. The whole tool is off in these modes and on connections set to them, GET included, because a GET route's code can still write.
- Sites managed by Royally. Only Royally's connection can use the tool, and a person approves each call there.
- Routes that are never allowed. WordPress core, batch, Royal MCP and sign-in routes stay out of reach, even if you list them.
- Activity log. Each call is recorded with its route, method and status. What was sent is not stored.
A call runs your route's own code, so Royal MCP Pro can't reverse what it does. Allow write methods only for routes you trust, and remember that a GET route can change data if its code does.
Common surprises
A route with a sign-in word in its address is refused. Words such as login, password and token count as sign-in routes, even inside a namespace you approved. The same check covers the data you send, so a field named password or a short value like action=login is refused too.
The call came back as an empty HTTP 500. The route ended the request itself, for example with wp_send_json() or exit. It may have done its work first, and the Activity log still has the call. Return a WP_REST_Response from the route instead.
A redirect isn't followed. The reply says the route asked to redirect and gives the address.
Text the route prints is dropped. Only the data the route returns reaches your AI agent.
A longer namespace needs its own approval. Approving vendor/v1 doesn't cover a separately registered vendor/v1/internal.
What each refusal means
| Code | What to do |
|---|---|
site_rest_off | No namespace is approved yet. Follow the steps above. |
namespace_not_approved | Add the namespace in Site REST routes, spelled exactly as the route registers it. |
method_not_allowed | Tick that method for the namespace, or check that the method is in capitals. |
route_never_allowed | This route can't be called with this tool, whatever the list says. |
path_not_allowed | Send a plain route such as /vendor/v1/items, with no encoding or query string. |
invalid_args | Check the arguments: query and body are objects, GET takes no body, and names can't start with an underscore. |
insufficient_caps | Connect your AI agent as an administrator. |
safety_mode | Turn off read-only or drafts-only mode for the site, then try again. |
managed_by_royally | Make the call through Royally. |
request_too_large | Send less: query is limited to 8 KB and body to 256 KB. |
response_too_large | The route ran, but its reply was over 256 KB. Ask the route for less. |
route_error | The route answered with an error status. The reply includes its message. |
route_failed | The route stopped while running. Check what it changed before you try again. |
response_unreadable | The route ran, but its reply could not be returned. Check what it changed. |
nested_route_refused | The route called another route that isn't approved. It appears as the route's own error. |
Still stuck? Two-step support path
Step 1: Start with the troubleshooting guide
Royal MCP Pro Troubleshooting: Start Here covers connection and license problems that can look like a route problem.
Step 2: Email priority support
Email priority support from your purchase email address at support@royalplugins.com.
- The refusal code and the full message from the reply
- The path and method you called
- The namespace and methods approved in Site REST routes
- Royal MCP Pro version