REST and headless front ends

Forms can be described, validated and submitted over the REST API, for the AJAX submit of rendered forms and for your own front end (React, Vue, an app).

The routes are open like the forms themselves: each request is checked against its form (who may use it, which fields). Without a valid token they do nothing (400).

#Describe

GET /wp-json/cafe/v1/forms/my-profile

{
	"id": "my-profile",
	"mode": "edit",
	"object_type": "user",
	"object_id": 12,
	"token": "eyJpZCI6…",
	"nonce": "a1b2c3d4e5",
	"submit": "",
	"post_fields": [],
	"post_terms": [],
	"fields": [
		{
			"key": "field_6512…",
			"name": "city",
			"label": "City",
			"type": "text",
			"required": true,
			"instructions": "",
			"settings": { "placeholder": "Amsterdam", "max_length": 80 },
			"value": "Utrecht"
		}
	]
}

Only display settings are included; saved passwords never are. Change the description with cafe_dynamic_form_field_description.

#Submit

Send form data or JSON:

{
	"_cafe_form": "eyJpZCI6…",
	"_cafe_form_nonce": "a1b2c3d4e5",
	"_cafe_form_submission": "a-random-uuid",
	"cafe": { "field_6512…": "Utrecht" },
	"cafe_post": { "title": "…", "terms": { "category": [ 3 ] } }
}

values and post are accepted as aliases of cafe and cafe_post.

The result has the same shape as cafe_submit_dynamic_form(): success, object_id, field_errors, form_errors, message, redirect.

#Authentication

• Cookie sessions (a front end on the same site): send WordPress's REST nonce (X-WP-Nonce) (apiFetch does this) plus the form nonce.
• Application passwords / other REST authentication: the request is already authenticated, so the form nonce may be left out.
• Visitors (forms with allow_guests): the form nonce is required.

Submissions with the same _cafe_form_submission key within 10 minutes return the first result, so retries are safe.