WordPress 7.1 introduces a unified `public` metadata flag for the Abilities API, giving plugin developers a single high-level way to declare that an ability is intended for external clients such as the REST API, MCP adapters, and AI agents. Previously, developers had to set channel-specific flags like `show_in_rest` separately for each integration. The new flag uses null-coalescing precedence: explicit channel-specific settings override the general `public` flag, while the `public` value serves as the default for any channel that hasn't been explicitly configured. The change is backward-compatible — existing `show_in_rest` registrations continue to work unchanged. Importantly, the `public` flag controls discoverability only and does not replace `permission_callback` for authorization. Three core abilities (`core/get-site-info`, `core/get-user-info`, `core/get-environment-info`) have been migrated to use the new flag.
Table of contents
Registering a public abilityHow exposure defaults are resolvedWhat problem does this change fix?Using public in other integrationsExposure is not authorisationChanges to resolved metadataBackward compatibilityWhen to use each flag391 Impressions1 Comment