Title: WP_REST_Abilities_V1_Run_Controller::coerce_input_to_schema
Published: August 20, 2026

---

# WP_REST_Abilities_V1_Run_Controller::coerce_input_to_schema( mixed $input, WP_Ability $ability ): mixed

## In this article

 * [Description](https://developer.wordpress.org/reference/classes/WP_REST_Abilities_V1_Run_Controller/coerce_input_to_schema/?output_format=md#description)
 * [Parameters](https://developer.wordpress.org/reference/classes/WP_REST_Abilities_V1_Run_Controller/coerce_input_to_schema/?output_format=md#parameters)
 * [Return](https://developer.wordpress.org/reference/classes/WP_REST_Abilities_V1_Run_Controller/coerce_input_to_schema/?output_format=md#return)
 * [Source](https://developer.wordpress.org/reference/classes/WP_REST_Abilities_V1_Run_Controller/coerce_input_to_schema/?output_format=md#source)
 * [Related](https://developer.wordpress.org/reference/classes/WP_REST_Abilities_V1_Run_Controller/coerce_input_to_schema/?output_format=md#related)
 * [Changelog](https://developer.wordpress.org/reference/classes/WP_REST_Abilities_V1_Run_Controller/coerce_input_to_schema/?output_format=md#changelog)

[ Back to top](https://developer.wordpress.org/reference/classes/WP_REST_Abilities_V1_Run_Controller/coerce_input_to_schema/?output_format=md#wp--skip-link--target)

This function’s access is marked private. This means it is not intended for use 
by plugin or theme developers, only by core. It is listed here for completeness.

Coerces raw request input to the types declared in the ability input schema.

## 󠀁[Description](https://developer.wordpress.org/reference/classes/WP_REST_Abilities_V1_Run_Controller/coerce_input_to_schema/?output_format=md#description)󠁿

GET and DELETE deliver every scalar as a string (“10”, “true”) and a list as a single
comma-separated string, so without coercion an ability receives raw strings where
its schema declares integers, booleans, or arrays.

Coercion never changes what validation accepts. Input is coerced only when [WP_Ability::validate_input()](https://developer.wordpress.org/reference/classes/WP_Ability/validate_input/)
already accepts it, and any error surfaced while sanitizing falls back to the raw
input, so `validate_input()` stays the single authority on what is rejected.

## 󠀁[Parameters](https://developer.wordpress.org/reference/classes/WP_REST_Abilities_V1_Run_Controller/coerce_input_to_schema/?output_format=md#parameters)󠁿

 `$input`mixedrequired

Raw input extracted from the request.

`$ability`[WP_Ability](https://developer.wordpress.org/reference/classes/wp_ability/)
required

The ability being executed.

## 󠀁[Return](https://developer.wordpress.org/reference/classes/WP_REST_Abilities_V1_Run_Controller/coerce_input_to_schema/?output_format=md#return)󠁿

 mixed Coerced input, or the raw input when it cannot be safely coerced.

## 󠀁[Source](https://developer.wordpress.org/reference/classes/WP_REST_Abilities_V1_Run_Controller/coerce_input_to_schema/?output_format=md#source)󠁿

    ```php
    private function coerce_input_to_schema( $input, WP_Ability $ability ) {
    	if ( null === $input ) {
    		return $input;
    	}

    	$schema = $ability->get_input_schema();
    	if ( empty( $schema ) ) {
    		return $input;
    	}

    	/*
    	 * Only coerce input that already validates. Sanitizing invalid input can silently
    	 * change which values are accepted -- `additionalProperties: false` strips unknown
    	 * keys, and a non-numeric string casts to 0 -- so leaving invalid input untouched
    	 * lets validate_input() reject it exactly as it does without coercion.
    	 *
    	 * validate_input() is asked rather than rest_validate_value_from_schema() so that the
    	 * `wp_ability_validate_input` filter decides what counts as valid here as well. A filter
    	 * that overrides a schema failure accepts the input, so the input is coerced; a filter
    	 * that rejects otherwise valid input leaves it untouched for validate_input() to report.
    	 */
    	if ( is_wp_error( $ability->validate_input( $input ) ) ) {
    		return $input;
    	}

    	$sanitized = rest_sanitize_value_from_schema( $input, $schema, 'input' );

    	/*
    	 * Sanitizing can still surface an error the lenient validation above did not, such as
    	 * items that are unique as strings but collide once cast to integers (`uniqueItems`).
    	 * The error may be returned at the top level or nested inside the returned array, so
    	 * scan recursively and fall back to the raw input on any error.
    	 */
    	if ( $this->input_contains_error( $sanitized ) ) {
    		return $input;
    	}

    	return $sanitized;
    }
    ```

[View all references](https://developer.wordpress.org/reference/files/wp-includes/rest-api/endpoints/class-wp-rest-abilities-v1-run-controller.php/)
[View on Trac](https://core.trac.wordpress.org/browser/tags/7.1/src/wp-includes/rest-api/endpoints/class-wp-rest-abilities-v1-run-controller.php#L268)
[View on GitHub](https://github.com/WordPress/wordpress-develop/blob/7.1/src/wp-includes/rest-api/endpoints/class-wp-rest-abilities-v1-run-controller.php#L268-L306)

## 󠀁[Related](https://developer.wordpress.org/reference/classes/WP_REST_Abilities_V1_Run_Controller/coerce_input_to_schema/?output_format=md#related)󠁿

| Uses | Description | 
| [WP_REST_Abilities_V1_Run_Controller::input_contains_error()](https://developer.wordpress.org/reference/classes/wp_rest_abilities_v1_run_controller/input_contains_error/)`wp-includes/rest-api/endpoints/class-wp-rest-abilities-v1-run-controller.php` |

Determines whether a sanitized value is, or contains, a [WP_Error](https://developer.wordpress.org/reference/classes/wp_error/).

  | 
| [rest_sanitize_value_from_schema()](https://developer.wordpress.org/reference/functions/rest_sanitize_value_from_schema/)`wp-includes/rest-api.php` |

Sanitize a value based on a schema.

  | 
| [is_wp_error()](https://developer.wordpress.org/reference/functions/is_wp_error/)`wp-includes/load.php` |

Checks whether the given variable is a WordPress Error.

  |

[Show 1 more](https://developer.wordpress.org/reference/classes/WP_REST_Abilities_V1_Run_Controller/coerce_input_to_schema/?output_format=md#)
[Show less](https://developer.wordpress.org/reference/classes/WP_REST_Abilities_V1_Run_Controller/coerce_input_to_schema/?output_format=md#)

| Used by | Description | 
| [WP_REST_Abilities_V1_Run_Controller::sanitize_input_for_ability()](https://developer.wordpress.org/reference/classes/wp_rest_abilities_v1_run_controller/sanitize_input_for_ability/)`wp-includes/rest-api/endpoints/class-wp-rest-abilities-v1-run-controller.php` |

Sanitizes the run input by coercing it to the ability’s input schema.

  |

## 󠀁[Changelog](https://developer.wordpress.org/reference/classes/WP_REST_Abilities_V1_Run_Controller/coerce_input_to_schema/?output_format=md#changelog)󠁿

| Version | Description | 
| [7.1.0](https://developer.wordpress.org/reference/since/7.1.0/) | Introduced. |

## User Contributed Notes

You must [log in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Fclasses%2Fwp_rest_abilities_v1_run_controller%2Fcoerce_input_to_schema%2F)
before being able to contribute a note or feedback.