WordPress REST API: Post Comments
The REST API has a route for comments: /wp-json/wp/v2/comments. You can list the comments of a post and send a new one from a front end like a React or mobile app. Let us see how it behaves.
Read comments
$ curl -s "http://example.com/wp-json/wp/v2/comments?post=1&_fields=id,post,author_name,content.rendered,status" | jq -c '.[]'
{"id":2,"post":1,"author_name":"Riya","status":"approved"}
{"id":1,"post":1,"author_name":"A WordPress Commenter","status":"approved"}
Approved comments of public posts can be read by everyone. Comments which wait for moderation can only be seen by users who can moderate.
Create a comment without a login
$ curl -s -X POST "http://example.com/wp-json/wp/v2/comments" -d "post=1" -d "author_name=Aman" -d "author_email=aman@example.com" -d "content=Great tutorial" | jq -c '{code, message, status: .data.status}'
{"code":"rest_comment_login_required","message":"Sorry, you must be logged in to comment.","status":401}
By default anonymous comments are not allowed in the REST API, even if the comment form on the site allows guests. This stops spam bots from using the API. The user must be logged in.
Allow anonymous comments with a filter
If you really need guests to comment through the API (for example, in a headless site), use the rest_allow_anonymous_comments filter in a plugin:
<?php
// Allow guests to post comments through the REST API.
add_filter( 'rest_allow_anonymous_comments', '__return_true' );
$ curl -s -X POST "http://example.com/wp-json/wp/v2/comments" -d "post=1" -d "author_name=Aman" -d "author_email=aman@example.com" -d "content=Great tutorial" | jq -c '{id, post, status, author_name}'
{"id":3,"post":1,"status":"hold","author_name":"Aman"}
$ curl -s -X POST "http://example.com/wp-json/wp/v2/comments" -d "post=1" -d "content=No name or email" | jq -c '{code, message}'
{"code":"rest_comment_author_data_required","message":"Creating a comment requires valid author name and email values."}
Now a guest can comment, but the comment is on hold (waiting for approval): WordPress treats it like a normal comment and the moderation settings apply. The name and the email are still required when the setting Comment author must fill out name and email is on. Note also that WordPress has a flood check: a guest who sends two comments within a few seconds gets an error.
Create a comment as a logged in user
$ curl -s -u "admin:APP_PASSWORD" -X POST "http://example.com/wp-json/wp/v2/comments" -d "post=1" -d "content=Thanks for reading everyone" | jq -c '{id, post, status, author_name}'
{"id":4,"post":1,"status":"approved","author_name":"admin"}
Update and delete
Changing or deleting a comment needs a login with the right capability:
$ curl -s -u "admin:APP_PASSWORD" -X POST "http://example.com/wp-json/wp/v2/comments/3" -H "Content-Type: application/json" -d '{"status":"approved"}' | jq -c '{id, status}'
{"id":3,"status":"approved"}
$ curl -s -u "admin:APP_PASSWORD" -X DELETE "http://example.com/wp-json/wp/v2/comments/3?force=true" | jq -c '{deleted}'
{"deleted":true}
Important fields
| Field | Meaning |
|---|---|
| post | ID of the post |
| parent | ID of the parent comment, for a reply |
| content | The comment text |
| author_name, author_email, author_url | Details of a guest commenter |
| status | approved, hold, spam or trash |
Be careful with spam
- Keep Akismet or another anti spam plugin active. It works with the REST API too.
- Keep the moderation on for guests.
- Add rate limiting or a captcha on your own front end before it calls the API.
| Exercises & Assignments |
|---|
| Get the latest posts with the REST API |
| Create a post with the REST API and an application password |
| Build a custom REST endpoint which greets a name |
| Interview Questions & Answers |
|---|
| What is the WordPress REST API? |
| How to create a custom REST API endpoint in WordPress? |