I want to display the list of posts from my wordpress blog on someother site along with the author name, title, date and description. Hence, I decided to use WP REST API V2. As per WP REST API Documentation I retrived the data in JSON format by following example URL http://example.com/wp-json/wp/v2/posts?_embed. I get all the information except author name. Here is the partial JSON

 "_embedded": {
      "author": [
          "code": "rest_user_invalid_id",
          "message": "Invalid user ID.",
          "data": {
            "status": 404

I also get same error if I try to visit the following link http://example.com/wp-json/wp/v2/users/1. I don't understand why this error occur even though the user exist. Does it deal with authentication?

Note: I had earlier modified a field in the WP database so that the actual user name is not displayed in urls and posts. However, I think this must not affect the JSON output because an another alias for user name is already present and displayed in my blog. Also, the same entries of my blog is displayed on another wordpress blog by a wordpress plugin which also shows the author name.

Please help me I am stuck and unable to find solution.

  • Im currently having this same issue, only after moving to production.
    – erwstout
    Apr 6 '17 at 22:44
  • Are you using the wordfence plugin? @geeksal
    – erwstout
    Apr 7 '17 at 0:11

Wordfence blocks the User endpoint from the public. In settings there is a checkbox you can unselect to make it visible in the WP Rest API again.


I know this is solved for op but for other users that come along from Google this is what I had to do:

  1. Go to WordFence "all options" page
  2. Search "rest" in the filter
  3. Uncheck the option "Prevent discovery of usernames through '/?author=N' scans, the oEmbed API, and the WordPress REST API"
  4. Go to LiteSpeed Cache and choose Purge All

You might be using different plugins for security and caching but the general idea remains:

  1. Make sure your security plugin isn't blocking access
  2. Clear your cache
  • 1
    Thanks, that made it much easier to find the option - and the reminder to flush my cache was really helpful too.
    – WebElaine
    Apr 8 at 12:45

If the user data is indeed being blocked by Wordfence (or another security plugin), and you want to continue to utilize that security feature, you can modify the REST API's response, and add in just the fields that you want to use (which would presumably reveal less data than what is exposed by the standard API call). This documentation explains about modifying API responses: https://developer.wordpress.org/rest-api/extending-the-rest-api/modifying-responses/. Gives you an additional option.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.