外掛標籤
開發者團隊
原文外掛簡介
Routemark adds a page under Tools that lists every REST API route registered on your site: core, WooCommerce, whatever your plugins and theme have added. Click a route to see its arguments and schema, fill in the parameters and send a request as the user you’re logged in as. No Postman, no copying nonces around, no application passwords for quick tests.
What you get:
The full route list, grouped by namespace, with a filter and method toggles.
Which plugin, theme or part of WordPress added each route, so wc/v3 shows up as WooCommerce. You can search by plugin name too.
Arguments for each endpoint, with types, defaults, allowed values and descriptions.
A request form that pre-fills query parameters from those arguments. Bodies for POST/PUT/PATCH can be filled in as a form built from the route’s arguments, with a check on each field before you send, or written as JSON.
The response with status, timing, size and the WordPress pagination headers, plus a collapsible JSON view you can search, a table view for lists, and the raw text. Links in the JSON open in Routemark, and Previous/Next pages through paged results.
Compare: send the same request as two users, or before and after a change, and see the difference line by line.
“Why was this refused?”: when a request comes back 401 or 403, Routemark shows which permission callback refused it, the capabilities it checks, and whether the user you sent as has them.
A recorder that catches the REST calls wp-admin makes while you work (the block editor, WooCommerce, any plugin screen), so you can open one in Routemark and send it again. Start and stop it from the admin bar.
Paste a cURL command to open it as a request.
Search routes by the fields they take or return, like “author” or “sku”.
Server numbers for every request you send: how many database queries it ran, how long PHP spent on it and peak memory. So you can tell a slow endpoint from a slow connection.
A Hooks tab that lists every plugin hooked into a route’s filters and actions (rest_prepare_post, rest_post_dispatch and so on), with the function, priority and plugin name. When a field shows up that you didn’t expect, or goes missing, this tells you who did it.
“Copy as code” for wp.apiFetch, fetch, cURL and PHP (rest_do_request).
“Send as”: send the same request as logged out, or as another user. Pick one user per role (an editor, a subscriber) or search for someone, and see exactly what they’d get back.
A history of the requests you sent, so you can go back to one.
Settings for history, confirming before DELETE (or any change), the default code language, how much of a JSON response opens, light or dark, and namespaces to hide.
A short list of endpoints that are open to anyone without logging in, which is handy when you’re checking what a site exposes.
A Report that goes through every route and flags the ones worth a look: no permission check at all, anyone allowed to change data, arguments WordPress never checks, and routes with no schema. Grouped by plugin, worst first, with a button to open each one as logged out. You can copy it as text for a ticket or a client.
A Site Health test that warns when a route lets anyone change data, with a link to the Report.
Only administrators (the manage_options capability) can see the page or the route list.
Requests you send from Routemark are real. A DELETE deletes. Use a staging or local site when you’re poking at things you don’t know.
Privacy
Routemark doesn’t contact any outside server and doesn’t collect anything. It only calls your own site’s REST API, and only when you press Send. Your settings are saved in the database as user meta (routemark_settings), one copy per user. They’re removed when you delete the plugin.
Request history and recorded calls are stored in your browser (localStorage), never in the database. They’re kept per WordPress user, you can turn history off or clear either one, and anything that looks like a secret (Authorization headers, fields named password, token, api_key and so on) is blanked before it’s saved. The recorder only runs for administrators, only after they start it, and only in their own browser.
Development
The files in build/ are compiled from TypeScript and SCSS but not minified, so you can read them as they are.
The source code and build setup are on GitHub: https://github.com/ClearanceClarence-Software/Routemark
To build it yourself you need Node 20 or newer:
npm ci
npm run build
npm run zip makes the same plugin zip that's published here.
Credits
Routemark bundles the Atkinson Hyperlegible Next and Atkinson Hyperlegible Mono fonts (Copyright 2020-2024 The Atkinson Hyperlegible Next / Mono Project Authors) and Bricolage Grotesque (Copyright 2022 The Bricolage Grotesque Project Authors), all licensed under the SIL Open Font License 1.1. The license text is in the licenses/ folder. The fonts are served from the plugin folder, not from Google.
