Pull live content from your WordPress site into a WhatsApp chatbot. Fetch posts, pages, property listings, event details, or any custom post type and share them with customers in real time, powered by the WordPress REST API and Application Password authentication.
Before following this guide, read the External API Request step foundation guide. It covers every field in the step interface so this guide can focus on WordPress-specific values.
The WordPress REST API is a content API, not an orders API. The use cases suited to it are:
| Use case | WordPress endpoint | What the bot does |
|---|---|---|
| Latest blog post bot | GET /wp-json/wp/v2/posts?per_page=1 | Customer asks 'latest news' and the bot fetches and shares your newest post title, excerpt, and link. |
| Property listing bot | GET /wp-json/wp/v2/properties/{id} | Customer sends a listing ID; bot returns the property details from a WP Real Estate or custom post type. |
| Event details bot | GET /wp-json/tribe/v1/events/{id} | Bot fetches event date, venue, and ticket link from The Events Calendar plugin. |
| FAQ / knowledge bot | GET /wp-json/wp/v2/pages/{id} | Bot fetches a specific WordPress page and shares its excerpt or content. |
| Product catalogue | GET /wp-json/wc/v3/products/{id} | Bot fetches WooCommerce product description, price, and stock status (see WooCommerce guide for orders). |
For WooCommerce ORDER lookups, use our dedicated WooCommerce guide which covers the consumer key/secret auth system.
The REST API endpoint /wp-json/ only works when WordPress pretty permalinks are enabled. Go to Settings > Permalinks in your WordPress admin and choose any option other than Plain.
WordPress Application Passwords are built into WordPress core since version 5.6. No plugin needed. They use HTTP Basic Auth with your WordPress username and the generated 24-character token.
xxxx xxxx xxxx xxxx xxxx xxxx. Copy it immediately.WordPress shows the generated token only once. If you close the page without copying it, you must delete it and generate a new one. The spaces in the 24-character string can be included or removed. Either format works in the Authorization header.
Create a separate WordPress user for API integrations (e.g. role: Author or Editor). Generate the Application Password for that user. If the token is ever compromised, you revoke one token without affecting your admin access.
WordPress Application Passwords: developer.wordpress.org/rest-api/using-the-rest-api/authentication
The example below fetches your latest blog post. In your WA.Expert chatbot flow, add an External API Request step with these values:
| Field | Value | Notes |
|---|---|---|
| Select Method | GET | Reading existing content. |
| Request URL | https://yoursite.com/wp-json/wp/v2/posts?per_page=1 | Replace yoursite.com with your domain. per_page=1 returns only the latest post. |
| Select Auth Type | Basic Auth | WordPress Application Passwords use HTTP Basic Auth. WA.Expert handles the Base64 encoding automatically. |
| Username (Basic Auth) | your-wordpress-username | Your WordPress login username. Not your display name or email. |
| Password (Basic Auth) | xxxx xxxx xxxx xxxx xxxx xxxx | The 24-character Application Password from Step 1. Spaces can be included or removed. |
| Content-Type | application/json | Standard header for WordPress REST API. |
| Select Body Type | None | GET requests carry no body. |
| Choose Response Type | JSON | WordPress returns an array of post objects. |
| What you want | Endpoint URL |
|---|---|
| Latest post | https://yoursite.com/wp-json/wp/v2/posts?per_page=1 |
| Specific post by ID | https://yoursite.com/wp-json/wp/v2/posts/123 |
| Specific page by ID | https://yoursite.com/wp-json/wp/v2/pages/45 |
| Search posts | https://yoursite.com/wp-json/wp/v2/posts?search=keyword |
| Custom post type by ID | https://yoursite.com/wp-json/wp/v2/properties/67 |
| WooCommerce product | https://yoursite.com/wp-json/wc/v3/products/89 |
Custom post type slugs vary by plugin. Replace 'properties' with whatever the plugin registers. Check with the plugin documentation.
A WordPress post response (single post from per_page=1) looks like this:
[
{
"id": 123,
"date": "2026-06-20T10:30:00",
"title": {
"rendered": "How WhatsApp API Is Changing Indian Retail"
},
"excerpt": {
"rendered": "Retailers across India are turning to WhatsApp as their primary customer channel. Here is what the numbers show.
"
},
"link": "https://yoursite.com/whatsapp-api-indian-retail/",
"author": 1,
"categories": [5],
"status": "publish"
}
]The posts endpoint returns an array even when per_page=1. Map your variables using [0] notation: [0].title.rendered for the title, [0].excerpt.rendered for the excerpt, [0].link for the URL.
Map these response paths to variables in the External API Request step:
| Variable name | Response path | Example value |
|---|---|---|
| post_title | [0].title.rendered | How WhatsApp API Is Changing Indian Retail |
| post_excerpt | [0].excerpt.rendered | Retailers across India are... (contains HTML tags: strip or use as-is) |
| post_url | [0].link | https://yoursite.com/whatsapp-api-indian-retail/ |
| post_date | [0].date | 2026-06-20T10:30:00 |
| post_id | [0].id | 123 |
The excerpt field contains HTML tags from WordPress. Most WhatsApp replies work fine with plain text only. Use the title and link and skip the excerpt or handle the HTML on the platform side.
If the customer messaged you first within the last 24 hours, your reply is a free service conversation. Send the content in that window. For proactive content broadcasts, use an approved Marketing template.
Customer sends keyword: "latest" or "news" Bot keyword trigger fires. External API Request step: GET https://yoursite.com/wp-json/wp/v2/posts?per_page=1&orderby=date&order=desc Auth: Basic your-username:your-app-password Response mapped: post_title = "How WhatsApp API Is Changing Indian Retail" post_url = "https://yoursite.com/whatsapp-api-indian-retail/" post_date = "2026-06-20T10:30:00" Bot replies: "Our latest article: *How WhatsApp API Is Changing Indian Retail* Published: 20 June 2026 Read it here: https://yoursite.com/whatsapp-api-indian-retail/ Reply SUBSCRIBE to get articles in WhatsApp."
| Symptom | Likely cause | Fix |
|---|---|---|
| 401 Unauthorized | Wrong username or Application Password | Check you are using the WordPress login username (not display name or email). Regenerate the Application Password if unsure. |
| 404 on /wp-json/ | Pretty permalinks disabled | Go to WordPress Settings > Permalinks, choose any option other than Plain, save. |
| 403 Forbidden | User role lacks permission for the endpoint | Use a user with Editor or higher role. Some endpoints are restricted to certain roles. |
| Empty array [] | No posts match the query | Check the per_page and status parameters. By default, only published posts are returned (status=publish). |
| HTML tags in excerpt | WordPress includes formatting in excerpt | Either accept the HTML or add &_fields=title,link,date to the URL to skip excerpt entirely. |
| Application Passwords section missing | WordPress site is multisite or using a security plugin that disabled it | On multisite installs, Application Passwords may need to be enabled via code or a plugin. Wordfence and iThemes Security can disable the feature. |
WooCommerce REST API v3 order lookup: Consumer Key and Secret auth, order status and total.
Read guide →Shopify Admin API order lookup: single X-Shopify-Access-Token header.
Read guide →Master every field in WA.Expert's HTTP action step before building any integration.
Read foundation guide →Free trial, no credit card required. And if you ever get stuck, we are the only platform in India that answers you live on WhatsApp.