wp-includes/connectors.php:697Masks and validates connector credentials in REST responses.
$responseWP_REST_Response$serverWP_REST_Server$requestWP_REST_RequestWP_REST_Responsefunction _wp_connectors_rest_settings_dispatch( WP_REST_Response $response, WP_REST_Server $server, WP_REST_Request $request ): WP_REST_Response { if ( '/wp/v2/settings' !== $request->get_route() ) { return $response; } $data = $response->get_data(); if ( ! is_array( $data ) ) { return $response; } $is_update = 'POST' === $request->get_method() || 'PUT' === $request->get_method(); foreach ( wp_get_connectors() as $connector_id => $connector_data ) { $auth = $connector_data['authentication']; if ( 'application_password' === $auth['method'] && ! empty( $auth['setting_name'] ) ) { $setting_name = $auth['setting_name']; if ( array_key_exists( $setting_name, $data ) && is_array( $data[ $setting_name ] ) ) { $password = $data[ $setting_name ]['password'] ?? ''; if ( is_string( $password ) && '' !== $password ) { $data[ $setting_name ]['password'] = str_repeat( "\u{2022}", 16 ); } } continue; } if ( 'api_key' !== $auth['method'] || empty( $auth['setting_name'] ) ) { continue; } $setting_name = $auth['setting_name']; if ( ! array_key_exists( $setting_name, $data ) ) { continue; } $value = $data[ $setting_name ]; // On update, validate AI provider keys before masking. // Non-AI connectors accept keys as-is; the service plugin handles its own validation. if ( $is_update && is_string( $value ) && '' !== $value && 'ai_provider' === $connector_data['type'] ) { if ( true !== _wp_connectors_is_ai_api_key_valid( $value, $connector_id ) ) { update_option( $setting_name, '' ); $data[ $setting_name ] = ''; continue; } } // Mask the key in the response. if ( is_string( $value ) && '' !== $value ) { $data[ $setting_name ] = _wp_connectors_mask_api_key( $value ); } } $response->set_data( $data ); return $response;}Introduced in 7.0.0. Unchanged from 7.0.4 through 7.1.0.
Signature, return type and hooks compared across 2 parsed releases.
src/wp-includes/connectors.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.