Register the Resource itself during rest_api_init; it creates and registers its own internal Router from restNamespace.
use BetterRoute\\Resource\\Resource;\nuse BetterRoute\\Resource\\ResourcePolicy;\n\nadd_action('rest_api_init', static function (): void {\n Resource::make('books')\n ->restNamespace('myapp/v1')\n ->sourceCpt('book')\n ->allow(['list', 'get', 'create', 'update', 'delete'])\n ->fields(['id', 'title', 'slug', 'content', 'status', 'author'])\n ->filters(['status', 'author'])\n ->filterSchema([\n 'status' => ['type' => 'enum', 'values' => ['publish', 'draft']],\n 'author' => 'int',\n ])\n ->sort(['date', 'title', 'id'])\n ->policy(ResourcePolicy::publicReadPrivateWrite('edit_posts'))\n ->writeSchema([\n 'title' => ['type' => 'string', 'required' => true, 'sanitize' => 'text'],\n 'status' => ['type' => 'enum', 'values' => ['draft', 'publish']],\n ])\n ->deleteMode('trash')\n ->register();\n});\nDo not pass a Router to Resource::register(). Its optional argument is a DispatcherInterface, intended mainly for tests/custom dispatch.
Omitting allow() registers full CRUD. In 1.1:
allow(['list', 'get']) creates a read-only Resource;allow([]) deliberately registers no routes;InvalidArgumentException;update covers both PUT and PATCH.Never configure both sourceCpt() and sourceTable(); the second call now throws.
Default visible statuses are ['publish']. Configure the source-verified method:
->cptVisibleStatuses(['publish', 'draft'])\nThere is no allowedStatuses() method.
1.1 fails closed on reads:
\ncan_read === true;id, status, password_protected, publicly_queryable, and can_read, even if the client did not request them;Prefer an explicit Resource policy even though public CPT reads have a safe default.
\nFor additional item logic:
\n->cptVisibilityPolicy(static function (array $item, string $action): bool {\n return ($item['tenant_id'] ?? null) === current_tenant_id();\n})\nThe callback receives the projected repository item plus action (list or get), not just a status and not the WP request.
An arbitrary PHP callback cannot be pushed into WP_Query. To keep total, pages, and page contents truthful, 1.1 scans every matched repository page, applies the callback, then slices the visible set. This can be expensive. On large datasets, implement visibility in a custom query-level repository/filter so the database produces the correct total.
List queries use:
\nfields=a,b,csort=field or sort=-fieldpage and per_pageConfigure sort field names without a - prefix:
->sort(['date', 'title', 'id'])\n// Client may request ?sort=-date\nAn empty sort configuration uses the defaults date and id; it is not an open/no-sort state. The repository adds ID as a stable tie-breaker.
Strict unknown-parameter checks allow WordPress globals _locale, _fields, _embed, _envelope, and _jsonp. This keeps wp.apiFetch's _locale=user compatible while rejecting other unknown input.
Configure pagination in any fluent order, but the final state must satisfy:
\ndefaultPerPage >= 1;maxPerPage >= 1;defaultPerPage <= maxPerPage;maxOffset >= 0.Exceeding maxPerPage or maxOffset returns 400 validation_failed; values are not silently clamped.
Use flat enum rules:
\n['type' => 'enum', 'values' => ['draft', 'publish']]\nUse br-write-schema for validation and br-resource-policy for action/field authorization. In 1.1 a denied fieldPolicy does not silently discard the field: it returns a validation error or 403 forbidden according to the rule type.
The default WordPressCptRepository also checks mapped CPT capabilities for create/update/delete and publishing/author changes. Resource route permission does not replace object-level WordPress capability checks.
Valid delete modes are force and trash.
Lists return {data, meta}. Create/update return {data}. A single get returns the raw item unless uniformEnvelope(true) is set; then it returns {data}.
After register(), call contracts() to export generated contracts. Provide <Resource>, <Resource>Input, <Resource>Response, and <Resource>ListResponse schemas in strict OpenAPI mode as applicable. Explicitly public Resource actions emit security: [].
restNamespace and exactly one source.allow() deliberately; distinguish omitted from [].values and field names without - in sort()._locale=user.br-resource-policy for action and field authorization.br-write-schema for payload validation.br-openapi for generated schemas/contracts.src/Resource/Resource.phpsrc/Resource/Cpt/WordPressCptRepository.phpsrc/Resource/Cpt/CptListQueryParser.phpsrc/Resource/ResourcePolicy.php