Using Basic Authentication as an Administrator, I am getting an error code 401 Unauthorized : [rest_cannot_view_plugins] Sorry, you are not allowed to manage plugins for this site. error when I attempt to access the GET /wp-json/wp/v2/plugins endpoint of my server. I can pull Post and Page info with no problem, but when I query against the plugins, I'm getting the 401 error. I've confirmed that the userid used in the API call should be able to manage plugins using the CLI tool:

#  wp user list-caps $USER | grep plugin

Any pointers would be appreciated.

  • 1
    What authentication method are you using and from what context are you making the request, for example are you making the request from an external location to the site in question or are you that specific user and on the current site domain and making the request from the site context?
    – Adam
    Commented Sep 11, 2020 at 16:52
  • I'm using Basic Authentication. I'm calling the API from off-host (on my workstation). But as I said, I can use the posts and pages API endpoints with no problem using the same credentials Commented Sep 11, 2020 at 19:15

2 Answers 2



I suggest the following:

curl --user username:password https://example.com/wp-json

The first request should succeed regardless because it will likely be (unless you've done otherwise) unsecured.

Then try:

curl --user username:password https://example.com/wp-json/wp/v2/plugins

If this fails you may not have the means to issue basic authentication requests, so add it for the purpose of testing.

Install the following:


I'd simply recommend placing that file in your site wp-content/mu-plugins directory. If the directory does not exist, create it first.

Then repeat the curl request:

curl --user username:password https://example.com/wp-json/wp/v2/plugins

If you are authenticated correctly, you should receive back a response appropriate for that endpoint.


  • I have tested this via first trying on an install 5.3.* and the route does not exist (as we should expect)
  • I have tested this on an install 5.5.* and the route does exist as expected but requires an authentication method (for testing I have used Basic Authentication) and you can read more about Authentication methods in general here: https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/

NOTE (on authentication):

Depending on what you are trying to achieve you may benefit from more robust authentication like OAuth or Application Passwords (see https://wordpress.org/plugins/application-passwords/) but here the choice is ultimately yours, Basic Authentication may suffice, but be mindful of security considerations around storing plain text username and passwords for the given user making the request. You may want to create a specific use with just enough permissions/capabilities for this purpose if relying on Basic Authentication.

Useful reading:

  • 2
    I believe you probably nailed the issue in your first suggestion. The site is currently running 5.4.2. I read through developer.wordpress.org/rest-api related to the Plugin API endpoint and dIdn't see anything that specified that this was a 5.5.x feature. Also didn't see it as listed as a new feature of the Release notes for 5.5 Eckstine release (or the various other 5.5 beta/pre-release I read). Thanks for the heads up though! Commented Sep 11, 2020 at 19:37
  • @WilliamMcVey neither did I see anything (concerning the Rest API docs). Coincidentally I have just begun using the very same EP for commercial purposes, so I had to go through the trial and error to determine the above so I suspect that will be the same for you. You'll need to check track for the 5.5 milestone to see everything: core.trac.wordpress.org/… (I've narrowed it down to the REST API for this example), second ticket from top closed out into this milestone. If this does the trick, feel free to mark the question. All the best.
    – Adam
    Commented Sep 11, 2020 at 21:12

It might have worked two years ago, but now it does not. The /plugins endpoint returns 401 regardless WP version. Running the latest WP version, logged in.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.