Registering a custom REST API endpoint in WordPress comes down to one function, register_rest_route(), called on the rest_api_init hook. The work that matters sits around it: a unique namespace, a permission_callback that reflects who should have access, validated and sanitized parameters, and responses that carry the right status codes. This guide builds three working routes, a public read, a read with a URL parameter and a protected create, then covers cookie and application-password authentication, schema-based validation, a test checklist with expected responses, and fixes for common errors such as rest_no_route and rest_forbidden, so you can verify each route.