wp-includes/rest-api/endpoints/class-wp-rest-menus-controller.php:86Checks whether the current user has read permission for the endpoint.
$requestWP_REST_Requesttrue|WP_ErrorOne hook fires while WP_REST_Menus_Controller::check_has_read_only_access() runs, in this order:
Filters whether the current user has read access to menu items via the REST API.
protected function check_has_read_only_access( $request ) { /** This filter is documented in wp-includes/rest-api/endpoints/class-wp-rest-menu-items-controller.php */ $read_only_access = apply_filters( 'rest_menu_read_access', false, $request, $this ); if ( $read_only_access ) { return true; } if ( current_user_can( 'edit_theme_options' ) ) { return true; } if ( current_user_can( 'edit_posts' ) ) { return true; } foreach ( get_post_types( array( 'show_in_rest' => true ), 'objects' ) as $post_type ) { if ( current_user_can( $post_type->cap->edit_posts ) ) { return true; } } return new WP_Error( 'rest_cannot_view', __( 'Sorry, you are not allowed to view menus.' ), array( 'status' => rest_authorization_required_code() ) ); }Introduced in 5.9.0. Unchanged from 6.7.7 through 7.1.0.
Signature, return type and hooks compared across 5 parsed releases.
src/wp-includes/rest-api/endpoints/class-wp-rest-menus-controller.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.