"code": "rest_cannot_read",
  "message": "Sorry, you are not allowed to view revisions of this post.",
  "data": {
    "status": 401

/wp-json/wp/v2/posts/"ID"/revisions (Im using this request)

  • 2
    Is the request authenticated? – Jacob Peattie Apr 2 '18 at 7:20
  • Lets clarify the later comment with a more specific type of authentication: are you logged in? If so, are you sending the X-WP-Nonce in your headers? – Jesús Franco Apr 4 '18 at 22:25

You should have a nonce provided by your WP instance, and of course, being authenticated previously (through cookies, set by the wp-login normal process, a JWT, or even Basic authentication). This is because some requests are not approved if they come without the nonce, in order to prevent abuse.

So, you could pass to your script a nonce generated from your backend, the example provided by the linked documentation is straightforward:

wp_localize_script( 'your-custom-id', 'wpApiSettings', array(
    'root' => esc_url_raw( rest_url() ),
    'nonce' => wp_create_nonce( 'wp_rest' )
) );

Pay attention to the example provided, it is using jQuery, however the API doesn't requires you to use it or even Backbone, in example I'm requesting the revisions of a post with Mithril like this:

m.request('/wp-json/wp/v2/posts/1/revisions', {
  headers: {
    'X-WP-Nonce': wpApiSettings.nonce
  .then(revisions => console.log(revisions))

Requests without this header, to the default Controllers will respond with a status code of 401.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.