Retrieves a parameter from the request.

$keystringrequired

Parameter name.

public function get_param( $key ) {
	$order = $this->get_parameter_order();

	foreach ( $order as $type ) {
		// Determine if we have the parameter for this type.
		if ( isset( $this->params[ $type ][ $key ] ) ) {
			return $this->params[ $type ][ $key ];
		}
	}

	return null;
}

View all references View on Trac View on GitHub

1. Skip to note 2 content

   get_param() checks parameter sources in this priority order (from get_parameter_order()): JSON body > POST body > GET query string > URL route params > registered defaults. The first source that HAS the key wins — even if that source is less “authoritative” than you’d expect.

   The gotcha: parameters captured by your route’s regex (e.g. the id in ‘/wpdocs/v1/users/(?P\d+)’) are checked SECOND TO LAST, after the query string. So a request to:

   /wp-json/wpdocs/v1/users/5?id=999

   …will have $request->get_param( ‘id’ ) return 999 (from the query string), NOT 5 (from the URL route). The same applies to a JSON body containing {“id”: 999} sent to that same URL.

   This matters if your code reads the same key in two different places and assumes they’ll agree — for example, doing a permission check against $request->get_url_params()[‘id’] (or the URL structure itself) but then using $request->get_param( ‘id’ ) for the actual database operation. Since the two can diverge, this pattern can lead to acting on a different resource than the one that was permission-checked.

   To avoid this, be explicit about which source you actually mean:

   // Only trust what the route regex captured, ignore query/body entirely.
   $id = $request->get_url_params()[‘id’] ?? null;

   // Or, if you specifically want query-string input, be explicit:
   $id = $request->get_query_params()[‘id’] ?? null;

   Reserve get_param() for cases where you genuinely want “whichever source provides this key first,” and use the specific getter (get_url_params(), get_query_params(), get_body_params(), get_json_params()) whenever the source matters — especially for any value used in a permission check or database query.