I'm trying to limit the content that is returned via REST API routes to only contain content published by the current logged in user. I'm trying to do this using pre_get_posts
which works fine when in the admin view but the REST API output is still including all posts.
In this case I am trying to do it via the REST route for a custom post type, so the route is /wp-json/wp/v2/todos/
. Accessing this route works fine by default and returns all posts, but with my pre_get_posts
code in place it still always returns all posts. Here is my pre_get_posts
code:
function only_users_todos( $query ) {
global $user_ID;
$query->set( 'author', $user_ID );
return $query;
}
add_filter( 'pre_get_posts', 'only_users_todos' );
Am I missing something obvious here, or does pre_get_posts
just not get called for REST API requests?
get_current_user_id()
instead?