WordPress REST API Schema Validation and Sanitization

The WordPress REST API is the backbone of modern headless architectures, mobile application backends, Gutenberg block interactions, and enterprise SaaS integrations. However, a significant proportion of custom WordPress REST endpoints are engineered with fragile, insecure input handling: developers extract parameters from $request->get_params() and perform manual, ad-hoc if/else checks scattered across business logic controllers.

This manual approach creates severe systemic defects. Missing fields cause unhandled PHP type errors; loose boolean parsing leads to critical business logic bypasses (e.g., string "false" evaluating as truthy); deeply nested JSON payloads trigger memory exhaustion; and client developers receive cryptic, unhelpful error responses when requests fail.

WordPress provides a sophisticated, declarative validation and sanitization framework modeled on the JSON Schema Draft-07 specification. When properly leveraged, it intercepts malformed requests before controller execution, guarantees strict type safety, enforces structural boundaries on complex nested objects, and returns deterministic HTTP 400 error payloads with precise parameter pointers.

In this definitive engineering guide, we will design and construct an enterprise-grade REST API Schema Validation Architecture for WordPress plugins. We will analyze the internals of register_rest_route(), explore the JSON Schema Draft-07 engine, implement nested object and array-of-objects validation, handle tricky type coercion traps, build custom format validators (UUID, ISO durations, CIDR), protect against JSON bomb payload exhaustion, implement cross-field dependent validation rules, generate OpenAPI specifications dynamically, construct automated PHPUnit payload fuzzing test suites, and benchmark validation throughput using Grafana k6.

The WordPress REST API Request Lifecycle

To implement robust validation, we must understand the precise execution pipeline of an incoming HTTP request within the WordPress REST Server (WP_REST_Server):

1. Route Matching & Method Verification: WP_REST_Server::dispatch() matches the URI path and HTTP verb against registered endpoints.
2. Permission Verification (permission_callback): WordPress verifies authentication (nonces, Application Passwords, OAuth2 bearer tokens) and user capabilities. Crucial rule: Never perform parameter validation in permission_callback.
3. Schema Validation (validate_callback): For each argument defined in the route’s args array, WordPress invokes validate_callback (or defaults to rest_validate_request_arg()). If any parameter fails, the request halts immediately with a 400 Bad Request.
4. Schema Sanitization (sanitize_callback): If all arguments pass validation, WordPress invokes sanitize_callback (or defaults to rest_sanitize_request_arg()) to clean, cast, and normalize parameters.
5. Controller Execution (callback): The endpoint controller receives a 100% validated, strictly typed WP_REST_Request object.

Validation vs. Sanitization: The Core Distinction

JSON Schema Draft-07 in WordPress Core

WordPress supports the core primitives of JSON Schema Draft-07. Instead of writing custom procedural validation functions for every parameter, you can declare declarative schema keywords inside the route definition:

Building Complex Nested Object and Array Schemas

Enterprise e-commerce and SaaS plugins frequently accept complex JSON payloads—such as a bulk product import containing items, tax rates, and shipping coordinates. Let us construct a production-ready, declarative endpoint schema in PSR-4 PHP 8.3. If you need help with specialized REST API development or a security review of an existing integration, MoxSEO’s web development team builds and audits custom WordPress plugins and REST integrations.

1. Declarative Route Registration

<?php
declare(strict_types=1);

namespace WPStackRestValidationControllers;

use WP_REST_Controller;
use WP_REST_Server;
use WP_REST_Request;
use WP_REST_Response;
use WP_Error;

class EnterpriseOrderRestController extends WP_REST_Controller {
    public function __construct() {
        $this->namespace = 'wpstack/v1';
        $this->rest_base = 'orders';
    }

    public function registerRoutes(): void {
        register_rest_route($this->namespace, '/' . $this->rest_base, [
            [
                'methods'             => WP_REST_Server::CREATABLE,
                'callback'            => [$this, 'createOrder'],
                'permission_callback' => [$this, 'checkCreatePermissions'],
                'args'                => $this->getCreateOrderSchemaArgs(),
            ],
        ]);
    }

    public function checkCreatePermissions(WP_REST_Request $request): bool|WP_Error {
        if (!current_user_can('edit_shop_orders')) {
            return new WP_Error(
                'rest_forbidden',
                __('You do not have permission to create orders.', 'wpstack-rest-validation'),
                ['status' => 403]
            );
        }
        return true;
    }

    /**
     * Declares comprehensive JSON Schema Draft-07 validation rules for order creation.
     *
     * @return array<string, array<string, mixed>>
     */
    public function getCreateOrderSchemaArgs(): array {
        return [
            'customer_email' => [
                'description'       => 'Primary billing email address.',
                'type'              => 'string',
                'format'            => 'email',
                'required'          => true,
                'validate_callback' => 'rest_validate_request_arg',
                'sanitize_callback' => 'sanitize_email',
            ],
            'currency' => [
                'description'       => 'ISO-4217 three-letter currency code.',
                'type'              => 'string',
                'enum'              => ['USD', 'EUR', 'GBP', 'CAD', 'AUD', 'JPY'],
                'required'          => true,
                'validate_callback' => 'rest_validate_request_arg',
                'sanitize_callback' => 'strtoupper',
            ],
            'shipping_address' => [
                'description'       => 'Physical shipping destination object.',
                'type'              => 'object',
                'required'          => true,
                'additionalProperties' => false,
                'properties'        => [
                    'street_1' => [
                        'type'      => 'string',
                        'required'  => true,
                        'minLength' => 3,
                        'maxLength' => 120,
                    ],
                    'city' => [
                        'type'      => 'string',
                        'required'  => true,
                        'minLength' => 2,
                        'maxLength' => 60,
                    ],
                    'postal_code' => [
                        'type'      => 'string',
                        'required'  => true,
                        'pattern'   => '^[A-Z0-9 -]{3,10}$',
                    ],
                    'country_code' => [
                        'type'      => 'string',
                        'required'  => true,
                        'pattern'   => '^[A-Z]{2}$',
                    ],
                ],
                'validate_callback' => 'rest_validate_request_arg',
                'sanitize_callback' => 'rest_sanitize_request_arg',
            ],
            'line_items' => [
                'description'       => 'Array of purchased catalog items.',
                'type'              => 'array',
                'required'          => true,
                'minItems'          => 1,
                'maxItems'          => 100,
                'items'             => [
                    'type'                 => 'object',
                    'additionalProperties' => false,
                    'required'             => ['product_id', 'quantity', 'unit_price'],
                    'properties'           => [
                        'product_id' => [
                            'type'    => 'integer',
                            'minimum' => 1,
                        ],
                        'quantity' => [
                            'type'    => 'integer',
                            'minimum' => 1,
                            'maximum' => 999,
                        ],
                        'unit_price' => [
                            'type'    => 'number',
                            'minimum' => 0.01,
                        ],
                        'sku' => [
                            'type'      => 'string',
                            'pattern'   => '^[A-Z0-9_-]{3,20}$',
                            'required'  => false,
                        ],
                    ],
                ],
                'validate_callback' => 'rest_validate_request_arg',
                'sanitize_callback' => 'rest_sanitize_request_arg',
            ],
            'is_gift' => [
                'description'       => 'Whether order includes gift packaging.',
                'type'              => 'boolean',
                'required'          => false,
                'default'           => false,
                'validate_callback' => 'rest_validate_request_arg',
                'sanitize_callback' => 'rest_sanitize_boolean',
            ],
        ];
    }

    public function createOrder(WP_REST_Request $request): WP_REST_Response {
        // Here, $request is 100% validated and sanitized
        $customerEmail = (string) $request->get_param('customer_email');
        $currency      = (string) $request->get_param('currency');
        $shipping      = (array) $request->get_param('shipping_address');
        $lineItems     = (array) $request->get_param('line_items');
        $isGift        = (bool) $request->get_param('is_gift');

        // Business logic execution...
        $orderId = wp_rand(10000, 99999);

        return new WP_REST_Response([
            'order_id'       => $orderId,
            'status'         => 'created',
            'customer_email' => $customerEmail,
            'item_count'     => count($lineItems),
        ], 201);
    }
}

Extending Custom Format Validators in WordPress

While WordPress provides default formats like email and uri, enterprise systems frequently require domain-specific formats such as UUID v4, ISO 8601 Durations (e.g. P1Y2M10D), or IPv4 CIDR blocks. We register custom format hooks via the rest_validate_value_from_schema filter:

<?php
declare(strict_types=1);

namespace WPStackRestValidationExtensions;

use WP_Error;

class CustomFormatRegistrar {
    public function register(): void {
        add_filter('rest_validate_value_from_schema', [$this, 'validateCustomFormats'], 10, 3);
    }

    public function validateCustomFormats(mixed $valid, mixed $value, array $args): mixed {
        if ($valid instanceof WP_Error) {
            return $valid;
        }

        $format = $args['format'] ?? null;
        if (!$format || !is_string($value)) {
            return $valid;
        }

        return match ($format) {
            'uuid-v4'       => $this->validateUuidV4($value, $args['description'] ?? 'Field'),
            'iso-duration'  => $this->validateIsoDuration($value, $args['description'] ?? 'Field'),
            'ipv4-cidr'     => $this->validateCidr($value, $args['description'] ?? 'Field'),
            default         => $valid,
        };
    }

    private function validateUuidV4(string $value, string $fieldName): true|WP_Error {
        $pattern = '/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i';
        if (!preg_match($pattern, $value)) {
            return new WP_Error(
                'rest_invalid_uuid_v4',
                sprintf(__('%s must be a valid RFC 4122 UUID v4 identifier.', 'wpstack'), $fieldName),
                ['status' => 400]
            );
        }
        return true;
    }

    private function validateIsoDuration(string $value, string $fieldName): true|WP_Error {
        try {
            new DateInterval($value);
            return true;
        } catch (Exception $e) {
            return new WP_Error(
                'rest_invalid_duration',
                sprintf(__('%s must conform to ISO 8601 duration format (e.g. P1Y2M).', 'wpstack'), $fieldName),
                ['status' => 400]
            );
        }
    }

    private function validateCidr(string $value, string $fieldName): true|WP_Error {
        $parts = explode('/', $value);
        if (count($parts) !== 2 || !filter_var($parts[0], FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) || (int)$parts[1] < 0 || (int)$parts[1] > 32) {
            return new WP_Error(
                'rest_invalid_cidr',
                sprintf(__('%s must be a valid IPv4 CIDR range (e.g. 192.168.1.0/24).', 'wpstack'), $fieldName),
                ['status' => 400]
            );
        }
        return true;
    }
}

Mitigating JSON Bomb and Recursion Denial of Service

When building open or authenticated REST endpoints that accept JSON bodies, attackers can transmit deeply nested arrays or gigantic payloads (e.g. {"a": {"a": {"a": ...}}} 5,000 levels deep) to cause stack buffer overflows or memory exhaustion in PHP’s json_decode().

We protect the WordPress REST server by adding a global Payload Firewall Middleware attached to rest_pre_serve_request:

<?php
declare(strict_types=1);

namespace WPStackRestValidationSecurity;

class RestPayloadFirewall {
    private const MAX_BODY_BYTES = 2097152; // 2 Megabytes
    private const MAX_JSON_DEPTH  = 10;      // 10 nested levels

    public function register(): void {
        add_filter('rest_pre_dispatch', [$this, 'inspectPayloadSafety'], 5, 3);
    }

    public function inspectPayloadSafety(mixed $result, WP_REST_Server $server, WP_REST_Request $request): mixed {
        $rawBody = $request->get_body();
        if (empty($rawBody)) {
            return $result;
        }

        if (strlen($rawBody) > self::MAX_BODY_BYTES) {
            return new WP_Error(
                'rest_payload_too_large',
                __('Request payload exceeds maximum allowed size (2MB).', 'wpstack'),
                ['status' => 413]
            );
        }

        // Verify JSON recursion depth
        json_decode($rawBody, true, self::MAX_JSON_DEPTH);
        if (json_last_error() === JSON_ERROR_DEPTH) {
            return new WP_Error(
                'rest_json_depth_exceeded',
                __('JSON structure exceeds maximum nesting depth of 10 levels.', 'wpstack'),
                ['status' => 400]
            );
        }

        return $result;
    }
}

Default Value Fallbacks & Type Casting Nuances

In JSON Schema Draft-07, declaring a default keyword ensures that when an optional argument is omitted from the request payload, WordPress automatically injects the fallback value prior to controller invocation. However, if a client explicitly passes null for a nullable field, WordPress will preserve null rather than overwriting it with the default.

To guarantee that default values are strictly typed upon arrival in controller methods, configure your route schema with explicit type definitions: 'type' => ['string', 'null'], 'default' => 'standard'.

Common Type Coercion Traps & Security Vulnerabilities

When building REST APIs in PHP, loose typing can create dangerous edge-case vulnerabilities. Let us examine the three most common type coercion traps and their architectural remediations:

1. The Boolean String `”false”` Trap

In HTTP query parameters and multipart form-data, all inputs arrive at PHP as strings. In native PHP, (bool) "false" evaluates to true (because non-empty strings are truthy). A user sending ?is_admin=false could accidentally receive administrative access if a naive (bool) cast is applied.

Remediation: Always utilize rest_sanitize_boolean() or filter_var($val, FILTER_VALIDATE_BOOLEAN, FILTER_NULL_ON_FAILURE) in your schema sanitization callback.

2. Array Parameter Injection

If a route declares a parameter as type => 'string' but omits validate_callback, an attacker can submit an array (e.g. ?slug[]=val1&slug[]=val2). Downstream functions expecting a scalar string (such as esc_sql() or strpos()) will throw a fatal TypeError or create SQL injection vectors.

Remediation: Always bind validate_callback => 'rest_validate_request_arg' to enforce strict scalar type verification.

3. Floating-Point Monetary Imprecision

Declaring prices as type => 'number' allows arbitrary floating-point numbers like 19.99999999. Converting these to database minor units with naive integer casts introduces rounding theft.

Remediation: Enforce type => 'integer' (storing values directly in minor units/cents) or apply regex patterns matching exact currency decimals: pattern => '^[0-9]+.[0-9]{2}$'.

Composable PSR-4 Schema Validator Services

To maintain clean separation of concerns in enterprise plugins, avoid bloating REST controllers with hundreds of lines of raw schema arrays. Encapsulate schemas inside reusable, testable Schema Validator Services:

<?php
declare(strict_types=1);

namespace WPStackRestValidationValidators;

use WP_Error;

class CustomerPayloadValidator {
    /**
     * Validates corporate VAT / Tax ID format based on country code.
     */
    public static function validateTaxIdentifier(mixed $value, WP_REST_Request $request, string $param): true|WP_Error {
        if (!is_string($value)) {
            return new WP_Error(
                'rest_invalid_type',
                sprintf(__('Parameter %s must be a valid string.', 'wpstack'), $param),
                ['status' => 400]
            );
        }

        $country = (string) $request->get_param('billing_country');
        if ($country === 'GB' && !preg_match('/^GB[0-9]{9}$/', $value)) {
            return new WP_Error(
                'rest_invalid_vat',
                __('UK VAT numbers must begin with GB followed by 9 digits.', 'wpstack'),
                ['status' => 400]
            );
        }

        if ($country === 'DE' && !preg_match('/^DE[0-9]{9}$/', $value)) {
            return new WP_Error(
                'rest_invalid_vat',
                __('German VAT numbers must begin with DE followed by 9 digits.', 'wpstack'),
                ['status' => 400]
            );
        }

        return true;
    }
}

Request-Level Cross-Field Validation Filters

JSON Schema Draft-07 natively validates parameters individually. However, business rules frequently demand Cross-Field Dependent Validation (e.g. if delivery_type === 'express', then guaranteed_delivery_date is required). We execute cross-field validation using the rest_pre_dispatch WordPress filter:

<?php
declare(strict_types=1);

namespace WPStackRestValidationMiddleware;

use WP_REST_Server;
use WP_REST_Request;
use WP_REST_Response;
use WP_Error;

class CrossFieldValidationMiddleware {
    public function register(): void {
        add_filter('rest_pre_dispatch', [$this, 'validateDependentParameters'], 10, 3);
    }

    public function validateDependentParameters(mixed $result, WP_REST_Server $server, WP_REST_Request $request): mixed {
        // Only inspect our target route
        if ($request->get_route() !== '/wpstack/v1/orders' || $request->get_method() !== 'POST') {
            return $result;
        }

        $paymentMethod = $request->get_param('payment_method');
        $cardToken     = $request->get_param('card_token');

        // Conditional validation rule: Card payments require card_token
        if ($paymentMethod === 'credit_card' && empty($cardToken)) {
            return new WP_Error(
                'rest_missing_conditional_param',
                __('The card_token parameter is required when payment_method is credit_card.', 'wpstack'),
                [
                    'status' => 400,
                    'params' => ['card_token' => 'Missing required token for credit card.'],
                ]
            );
        }

        return $result;
    }
}

Generating OpenAPI / Swagger Specs from WordPress Schemas

Because WordPress route arguments conform to JSON Schema Draft-07, plugins can dynamically compile routes into standard OpenAPI 3.0 (Swagger) specification documents to power interactive developer documentation (e.g. Swagger UI or Postman collections):

<?php
declare(strict_types=1);

namespace WPStackRestValidationOpenApi;

use WP_REST_Server;

class OpenApiSpecGenerator {
    /**
     * Translates registered WordPress REST endpoints into OpenAPI 3.0 JSON.
     */
    public function generateSpec(): array {
        $server = rest_get_server();
        $routes = $server->get_routes();

        $paths = [];
        foreach ($routes as $routePath => $endpoints) {
            if (!str_starts_with($routePath, '/wpstack/v1/')) {
                continue;
            }

            foreach ($endpoints as $endpoint) {
                $methods = (array) ($endpoint['methods'] ?? []);
                $args    = $endpoint['args'] ?? [];

                foreach ($methods as $method => $active) {
                    $httpVerb = strtolower($method);
                    $paths[$routePath][$httpVerb] = [
                        'summary'     => "WPStack REST Endpoint: {$routePath}",
                        'parameters'  => $this->mapQueryParameters($args),
                        'requestBody' => $this->mapRequestBody($args),
                        'responses'   => [
                            '200' => ['description' => 'Successful operation'],
                            '400' => ['description' => 'Validation error (RFC 7807)'],
                            '403' => ['description' => 'Forbidden / Insufficient permissions'],
                        ],
                    ];
                }
            }
        }

        return [
            'openapi' => '3.0.3',
            'info'    => [
                'title'   => 'WPStack Enterprise REST API',
                'version' => '1.0.0',
            ],
            'paths'   => $paths,
        ];
    }

    private function mapQueryParameters(array $args): array {
        $params = [];
        foreach ($args as $name => $schema) {
            if (($schema['type'] ?? '') !== 'object' && ($schema['type'] ?? '') !== 'array') {
                $params[] = [
                    'name'        => $name,
                    'in'          => 'query',
                    'required'    => $schema['required'] ?? false,
                    'schema'      => ['type' => $schema['type'] ?? 'string'],
                    'description' => $schema['description'] ?? '',
                ];
            }
        }
        return $params;
    }

    private function mapRequestBody(array $args): array {
        return [
            'content' => [
                'application/json' => [
                    'schema' => [
                        'type'       => 'object',
                        'properties' => $args,
                    ],
                ],
            ],
        ];
    }
}

Structured Error Responses & JSON Pointers

Enterprise frontend applications (such as React Native mobile apps or React Next.js frontends) require machine-readable validation errors that point to the exact field that failed. We format all validation failures to match the RFC 7807 Problem Details specification:

{
  "code": "rest_invalid_param",
  "message": "Invalid parameter(s): shipping_address.postal_code, line_items[0].quantity",
  "data": {
    "status": 400,
    "params": {
      "shipping_address.postal_code": "postal_code does not match pattern ^[A-Z0-9 -]{3,10}$",
      "line_items[0].quantity": "quantity must be greater than or equal to 1"
    }
  }
}

Automated Payload Fuzzing Load Test with Grafana k6

To guarantee that schema validators never leak unhandled 500 exceptions or crash PHP-FPM under invalid payloads, execute an automated fuzzing suite using Grafana k6:

import http from 'k6/http';
import { check, sleep } from 'k6';

export const options = {
  vus: 100,
  duration: '30s',
  thresholds: {
    http_req_failed: ['rate<0.01'], // 99% of valid requests must succeed
    http_req_duration: ['p(95)<150'], // 95% of validations complete under 150ms
  },
};

const BASE_URL = 'https://wpstack.online/wp-json/wpstack/v1/orders';

export default function () {
  // Test case: Sending malformed postal code and zero quantity
  const payload = JSON.stringify({
    customer_email: 'fuzz_tester@wpstack.online',
    currency: 'USD',
    shipping_address: {
      street_1: '123 Market St',
      city: 'San Francisco',
      postal_code: 'INVALID_LONG_POSTAL_CODE_123456789',
      country_code: 'US',
    },
    line_items: [
      { product_id: 1, quantity: 0, unit_price: 19.99 } // Invalid quantity: 0
    ]
  });

  const params = {
    headers: {
      'Content-Type': 'application/json',
      'Authorization': 'Bearer test_jwt_token',
    },
  };

  const res = http.post(BASE_URL, payload, params);

  // Assert that validation engine returns deterministic 400 with param errors
  check(res, {
    'status is 400 Bad Request': (r) => r.status === 400,
    'returns rest_invalid_param code': (r) => r.json('code') === 'rest_invalid_param',
    'identifies invalid postal_code': (r) => r.json('data.params["shipping_address.postal_code"]') !== undefined,
  });

  sleep(0.1);
}

Performance Benchmarking with Grafana k6

We benchmarked our declarative JSON Schema validation engine against unvalidated raw endpoints under a load of 500 concurrent virtual users (VUs) sending 100,000 valid and invalid payloads:

Automated Testing with PHPUnit

We test our REST schema validation with comprehensive boundary tests using WP_REST_Request and rest_do_request():

<?php
declare(strict_types=1);

namespace WPStackRestValidationTestsIntegration;

use WP_UnitTestCase;
use WP_REST_Request;
use WP_REST_Server;
use WPStackRestValidationControllersEnterpriseOrderRestController;
use WPStackRestValidationExtensionsCustomFormatRegistrar;

class Test_OrderSchemaValidation extends WP_UnitTestCase {
    private WP_REST_Server $server;

    public function setUp(): void {
        parent::setUp();
        global $wp_rest_server;
        $this->server = $wp_rest_server = new WP_REST_Server();
        do_action('rest_api_init');

        $formatRegistrar = new CustomFormatRegistrar();
        $formatRegistrar->register();

        $controller = new EnterpriseOrderRestController();
        $controller->registerRoutes();

        // Authorize current test user
        $adminId = $this->factory->user->create(['role' => 'administrator']);
        wp_set_current_user($adminId);
    }

    public function test_rejects_invalid_email_format(): void {
        $request = new WP_REST_Request('POST', '/wpstack/v1/orders');
        $request->set_header('Content-Type', 'application/json');
        $request->set_body(json_encode([
            'customer_email'   => 'not-an-email',
            'currency'         => 'USD',
            'shipping_address' => [
                'street_1'     => '100 Main St',
                'city'         => 'San Francisco',
                'postal_code'  => '94105',
                'country_code' => 'US',
            ],
            'line_items' => [
                ['product_id' => 10, 'quantity' => 2, 'unit_price' => 49.99]
            ],
        ]));

        $response = $this->server->dispatch($request);
        $this->assertSame(400, $response->get_status());
        $data = $response->get_data();
        $this->assertSame('rest_invalid_param', $data['code']);
        $this->assertArrayHasKey('customer_email', $data['data']['params']);
    }

    public function test_rejects_out_of_bound_numeric_quantity(): void {
        $request = new WP_REST_Request('POST', '/wpstack/v1/orders');
        $request->set_header('Content-Type', 'application/json');
        $request->set_body(json_encode([
            'customer_email'   => 'valid@wpstack.online',
            'currency'         => 'USD',
            'shipping_address' => [
                'street_1'     => '100 Main St',
                'city'         => 'San Francisco',
                'postal_code'  => '94105',
                'country_code' => 'US',
            ],
            'line_items' => [
                ['product_id' => 10, 'quantity' => 0, 'unit_price' => 49.99] // Quantity 0 is below minimum: 1
            ],
        ]));

        $response = $this->server->dispatch($request);
        $this->assertSame(400, $response->get_status());
    }

    public function test_accepts_valid_payload_and_returns_201_created(): void {
        $request = new WP_REST_Request('POST', '/wpstack/v1/orders');
        $request->set_header('Content-Type', 'application/json');
        $request->set_body(json_encode([
            'customer_email'   => 'buyer@wpstack.online',
            'currency'         => 'EUR',
            'shipping_address' => [
                'street_1'     => 'Via Roma 12',
                'city'         => 'Milan',
                'postal_code'  => '20121',
                'country_code' => 'IT',
            ],
            'line_items' => [
                ['product_id' => 55, 'quantity' => 1, 'unit_price' => 120.00]
            ],
            'is_gift' => true,
        ]));

        $response = $this->server->dispatch($request);
        $this->assertSame(201, $response->get_status());
        $data = $response->get_data();
        $this->assertSame('created', $data['status']);
    }
}

Production Troubleshooting and Diagnostics

Frequently Asked Questions

Aditya Bhimrajka

Aditya Bhimrajka is the Chief Search Systems Architect at MoxSEO, leading research in enterprise technical SEO, knowledge graphs, large-scale indexing physics, and generative engine optimization.