Abilities API Improvements in WordPress 7.1: Validation Hooks, Lifecycle Actions, and Schema Enhancements

Introduction to Abilities API Updates in WordPress 7.1

WordPress 7.1 introduces major enhancements to the Abilities API, building on the core foundations established in version 6.9. These updates give developers deeper control over data validation, telemetry tracking, user profile management, and REST API payload handling. By standardizing core schemas and providing precise lifecycle hooks, WordPress makes programmatic interactions cleaner and more reliable for plugins, themes, and external machine-driven clients.

Custom Input and Output Validation Hooks

While the Abilities API natively validates data against each ability’s defined JSON Schema, complex business logic often requires deeper validation rules that schemas alone cannot express. WordPress 7.1 adds two dedicated filters to intercept and augment validation routines: wp_ability_validate_input and wp_ability_validate_output.

Each filter receives three arguments: the existing validation result, the value being evaluated, and the programmatic ability name. Note that REST-style validate_callback and sanitize_callback schema keywords are not executed by the Abilities API, making these new filters the primary method for runtime validation.

add_filter( 'wp_ability_validate_input', function ( $is_valid, $input, $ability_name ) {
    if ( 'my-plugin/send-message' !== $ability_name ) {
        return $is_valid;
    }

    // Preserve errors produced by the default schema validation.
    if ( is_wp_error( $is_valid ) ) {
        return $is_valid;
    }

    if ( ! is_array( $input ) || empty( $input['recipient'] ) || ! str_ends_with( $input['recipient'], '@example.com' ) ) {
        return new WP_Error( 'invalid_recipient', __( 'The recipient must use the example.com domain.', 'my-plugin' ) );
    }

    return true;
}, 10, 3 );

Callbacks should return true when the payload is valid, or a WP_Error object if validation fails. Returning a boolean false will also fail validation, but WordPress automatically converts it into a generic error instance.

Observing Every Invocation with wp_ability_invoked

For auditing, telemetry, debugging, and accounting, WordPress 7.1 adds the wp_ability_invoked action hook. It fires at the very beginning of the WP_Ability::execute() method before any input normalization, permission checks, schema processing, or short-circuiting takes place.

do_action( 'wp_ability_invoked', $this->name, $input, $this );

Because this action executes universally, it fires even for calls that contain invalid input, trigger permission errors, hit cache layers, or require approval. Developers should use caution with raw, unnormalized input received by this action to prevent accidentally logging sensitive information like credentials or personal data.

Expanded User Information and Selective Field Responses

The core ability core/get-user-info has been significantly expanded in WordPress 7.1. It now returns five additional user profile properties for the authenticated requester:

• first_name
• last_name
• nickname
• description
• user_url

Additionally, the roles property is now strictly normalized using array_values() to guarantee consistent JSON array encoding, avoiding associative array key discrepancies. Callers can also request a subset of data using the optional fields input property:

$ability = wp_get_ability( 'core/get-user-info' );
$result = $ability->execute( array(
    'fields' => array( 'display_name', 'first_name', 'last_name' ),
) );

If an unknown field name is passed inside the request, execution halts and yields an ability_invalid_input error before the callback executes.

Consistent Schemas Across Core Abilities

Core system abilities—including core/get-site-info, core/get-user-info, and core/get-environment-info—now adhere to unified schema conventions. Every output property explicitly declares a translatable, Title Case title alongside a descriptive summary. This standardization helps AI agents, MCP (Model Context Protocol), WebMCP, and REST clients accurately read, present, and select abilities.

Furthermore, core/get-environment-info now supports the selective fields parameter just like user and site lookups. Developers can discover these capabilities programmatically by querying the REST discovery endpoint at /wp-json/wp-abilities/v1/abilities.

Typed Input Coercion for REST Ability Runs

When running abilities over REST endpoints using HTTP GET or DELETE methods, incoming query parameters are natively transmitted as strings. For example, integers arrive as "10" and booleans as "true". In previous releases, this caused strict type comparisons inside callbacks to fail unless custom casting was manually implemented.

WordPress 7.1 automatically coerces REST run inputs into the native types defined within the ability’s input schema prior to execution. The coercion mechanism hooks directly into the input argument’s sanitize_callback. As a result, both permission checks and execution handlers receive natively typed values while maintaining strict JSON Schema validation boundaries.

Primary reference: Review the original announcement for exact release details. This article is an independent explanation and does not reproduce the source text.