WordPress Core Expands Abilities REST API and View Config Endpoint

WordPress shipped 34 commits on master this week, mostly around the 7.1 alpha line tracked in version.php. The meaningful work for data and platform engineers sits in three clusters: a maturing Abilities API with REST query filters, a new View Config endpoint for admin list views, and tighter content sanitization in the KSES and excerpt paths.

The Abilities API is WordPress core’s registry for callable operations that external agents and internal services can discover at runtime. This week it picked up two commits that matter if you integrate against /wp-abilities/v1/abilities.

Refine filtering and expose meta over REST changes how callers narrow the ability list. The category argument now accepts a single slug, aligned with namespace. If you need multiple categories, the commit message points you at item_include_callback instead of overloading the query string. A new meta query parameter joins category and namespace. Conditions combine with AND logic, support nesting, and coerce known annotation keys (readonly, destructive, idempotent) to booleans before matching.

The security detail is worth noting. The abilities list controller always forces meta[show_in_rest] => true after merging caller supplied meta. A client cannot use the meta filter to surface abilities that core marked as hidden from REST.

Abilities schemas and REST route schemas previously diverged on which JSON Schema keywords survived serialization. Add a shared helper for JSON Schema allowed keywords introduces wp_get_json_schema_allowed_keywords() in a new json schema module.

The helper supports two profiles. rest-api is the default for route output. draft-04 is the wider set used when publishing schemas to API clients such as the Abilities list controller. Route schema output now flows through the helper and the wp_json_schema_allowed_keywords filter. Validation internals still call rest_get_allowed_schema_keywords() directly, so request validation behavior stays unchanged.

oandregal’s view config commit ports a large Gutenberg plugin feature into core. The new wp_get_entity_view_config( $kind, $name ) function builds the shared DataViews and DataForm configuration for an entity: default view, layouts, view list, and form fields. Core registers default providers for page, post, wp_block, wp_template_part, and wp_template post types. Plugins hook get_entity_view_config_{$kind}_{$name} to supply their own entity definitions.

The REST surface is GET /wp/v2/view-config?kind=...&name=..., handled by WP_REST_View_Config_Controller. It delegates to the PHP API, enforces an edit_posts permission check, and normalizes empty object serialization. The diff adds roughly 1,600 lines across the view config module and the controller. If you run headless admin tools or sync editorial UIs against WordPress, this endpoint is the canonical source for which columns, filters, and form fields an entity exposes.

The AI Client subsystem received three small but operator relevant fixes.

Skip non ability function calls in execute_abilities() fixes a routing bug in the ability function resolver. Before the change, execute_abilities() forwarded every function call part to execute_ability(), returning invalid_ability_call for tool calls that belonged to other handlers. The method now mirrors has_ability_calls() and checks is_ability_call() before executing.

Allow customization of the AI Client object cache group adds the wp_ai_client_cache_group filter in the AI client cache adapter. The default group remains wp_ai_client, but multi tenant hosts can redirect AI prompt and response cache entries to a dedicated object cache namespace.

Content sanitization saw two KSES updates and one excerpt fix that affect what text leaves the database toward feeds, search indexes, and REST excerpt.rendered fields.

Allow SVG presentation attributes in safe_style_css extends safecss_filter_attr() in kses.php with SVG presentation properties such as fill, stroke, and stroke-width. Add command and commandfor to allowed button attributes whitelists the HTML command and commandfor attributes on <button> elements.

On the excerpt side, Honor the block visibility metadata in generated excerpts closes a data leak. Auto generated excerpts previously ignored metadata.blockVisibility, so hidden blocks still contributed text even when the front end renderer skipped them. The fix in excerpt_remove_blocks() skips any block where metadata.blockVisibility is boolean false, including nested inner blocks.

The Abilities API and View Config endpoint are still alpha surface in the 7.1 line. Query parameter shapes may evolve before release. If you cache ability discovery responses or view config payloads, version your cache keys against the alpha build number in version.php.

The AI Client changes assume you may run mixed tool handlers alongside ability calls. Audit any custom resolver plugins to confirm they register before the ability resolver consumes unmatched calls.

KSES expansions for SVG and button commands widen the HTML that survives wp_kses_post(). If you run strict HTML allowlists in ETL jobs that mirror WordPress content, refresh your parsers to accept the new attributes without treating them as contamination.