wcm-abilities-api

WooCommerce Memberships: Abilities API

Use this when building or reviewing privileged automation around Memberships plans, user memberships, and per-post content restriction rules through the WordPress Abilities API.

Misconception this skill corrects

"Memberships abilities are customer-facing REST endpoints for headless member dashboards."

They are privileged Abilities API operations. Plan and user-membership abilities check manage_woocommerce. The 1.29.0 post-restriction abilities check manage_woocommerce_membership_plans; the GET ability also reaches the trait's numeric edit_post check because its input is the post ID. The UPDATE ability input is an object/array, so add your own edit_post guard when wrapping it. Use these abilities for admin/editor/agent automation, not untrusted frontend flows.

When to use this skill

Trigger when ANY of the following is true:

• The task mentions WordPress Abilities API, wp_register_ability(), wp_get_ability(), wp_abilities_api_init, or agent automation for Memberships.
• Code contains ability names beginning with woocommerce-memberships/.
• Code needs to create/list/get/delete Memberships plans or user memberships through an ability layer instead of direct PHP APIs.
• Code reads or writes /wc-memberships/v1/post-restriction-rules/{id} or uses the block editor Memberships sidebar restriction entity.
• You are deciding whether to use Memberships REST API, PHP APIs, or Abilities API.

Registration facts

Memberships 1.28.0+ implements the SkyVerge framework HasAbilitiesContract in WC_Memberships. The framework initializes ability registration only when WordPress exposes both:

function_exists( 'wp_register_ability' )
function_exists( 'wp_register_ability_category' )

On supported WordPress versions, the framework hooks:

Hook	Purpose
wp_abilities_api_categories_init	Registers Memberships ability categories.
wp_abilities_api_init	Registers the abilities.
rest_api_init	Registers framework REST routes only for abilities with explicit RestConfig. In 1.29.0 this applies to the post-restriction rule GET/PUT abilities.