Title: WP_REST_Attachments_Controller::validate_sub_size_provenance
Published: August 20, 2026

---

# WP_REST_Attachments_Controller::validate_sub_size_provenance( int $attachment_id, array $sub_sizes ): true|󠀁[WP_Error](https://developer.wordpress.org/reference/classes/wp_error/)󠁿

## In this article

 * [Description](https://developer.wordpress.org/reference/classes/wp_rest_attachments_controller/validate_sub_size_provenance/?output_format=md#description)
 * [Parameters](https://developer.wordpress.org/reference/classes/wp_rest_attachments_controller/validate_sub_size_provenance/?output_format=md#parameters)
 * [Return](https://developer.wordpress.org/reference/classes/wp_rest_attachments_controller/validate_sub_size_provenance/?output_format=md#return)
 * [Source](https://developer.wordpress.org/reference/classes/wp_rest_attachments_controller/validate_sub_size_provenance/?output_format=md#source)
 * [Related](https://developer.wordpress.org/reference/classes/wp_rest_attachments_controller/validate_sub_size_provenance/?output_format=md#related)
 * [Changelog](https://developer.wordpress.org/reference/classes/wp_rest_attachments_controller/validate_sub_size_provenance/?output_format=md#changelog)

[ Back to top](https://developer.wordpress.org/reference/classes/wp_rest_attachments_controller/validate_sub_size_provenance/?output_format=md#wp--skip-link--target)

Validates the `sub_sizes` file names against what this attachment produced.

## 󠀁[Description](https://developer.wordpress.org/reference/classes/wp_rest_attachments_controller/validate_sub_size_provenance/?output_format=md#description)󠁿

The [WP_REST_Attachments_Controller::finalize_item()](https://developer.wordpress.org/reference/classes/wp_rest_attachments_controller/finalize_item/)
method stores the client-supplied `file` and `original_image` values in the attachment
metadata, where they are later resolved within the attachment’s upload directory
and read or deleted (for example by [wp_get_original_image_path()](https://developer.wordpress.org/reference/functions/wp_get_original_image_path/),
[wp_getimagesize()](https://developer.wordpress.org/reference/functions/wp_getimagesize/),
and [wp_delete_attachment_files()](https://developer.wordpress.org/reference/functions/wp_delete_attachment_files/)).

Every file the sideload endpoint creates is recorded under [WP_REST_Attachments_Controller::META_KEY_SIDELOAD_FILE_NAME](https://developer.wordpress.org/reference/classes/wp_rest_attachments_controller/META_KEY_SIDELOAD_FILE_NAME/)
as it is produced, using server-generated names. finalize accepts a `file` or `original_image`
value only when it matches one of those recorded names (or the attachment’s own 
attached file, which it definitionally owns).

## 󠀁[Parameters](https://developer.wordpress.org/reference/classes/wp_rest_attachments_controller/validate_sub_size_provenance/?output_format=md#parameters)󠁿

 `$attachment_id`intrequired

The attachment being finalized.

`$sub_sizes`arrayrequired

Sub-size metadata collected from sideloads.

## 󠀁[Return](https://developer.wordpress.org/reference/classes/wp_rest_attachments_controller/validate_sub_size_provenance/?output_format=md#return)󠁿

 true|[WP_Error](https://developer.wordpress.org/reference/classes/wp_error/) True
if every file name was produced here, [WP_Error](https://developer.wordpress.org/reference/classes/wp_error/)
otherwise.

## 󠀁[Source](https://developer.wordpress.org/reference/classes/wp_rest_attachments_controller/validate_sub_size_provenance/?output_format=md#source)󠁿

    ```php
    protected function validate_sub_size_provenance( int $attachment_id, array $sub_sizes ) {
    	$allowed = $this->get_sideloaded_file_names( $attachment_id );

    	foreach ( $sub_sizes as $sub_size ) {
    		foreach ( array( 'file', 'original_image' ) as $key ) {
    			/*
    			 * Every value that was sent is checked, no matter how unlikely
    			 * a name it looks. A loose emptiness test would wave through
    			 * '0', which is a valid one-character name as far as the schema
    			 * is concerned and is stored like any other. A value the schema
    			 * types as a string but which arrives as something else is
    			 * rejected rather than skipped, so a subclass which widens the
    			 * schema cannot pass an unchecked value on to the metadata.
    			 */
    			if ( ! isset( $sub_size[ $key ] ) ) {
    				continue;
    			}

    			if ( ! is_string( $sub_size[ $key ] ) || ! in_array( $sub_size[ $key ], $allowed, true ) ) {
    				return new WP_Error(
    					'rest_invalid_sub_size_file',
    					__( 'Invalid sub-size file name. File names must have been produced by a prior sideload for this attachment.' ),
    					array( 'status' => 400 )
    				);
    			}
    		}
    	}

    	return true;
    }
    ```

[View all references](https://developer.wordpress.org/reference/files/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php/)
[View on Trac](https://core.trac.wordpress.org/browser/tags/7.1/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php#L3087)
[View on GitHub](https://github.com/WordPress/wordpress-develop/blob/7.1/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php#L3087-L3116)

## 󠀁[Related](https://developer.wordpress.org/reference/classes/wp_rest_attachments_controller/validate_sub_size_provenance/?output_format=md#related)󠁿

| Uses | Description | 
| [WP_REST_Attachments_Controller::get_sideloaded_file_names()](https://developer.wordpress.org/reference/classes/wp_rest_attachments_controller/get_sideloaded_file_names/)`wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php` |

Returns the file names which a finalize request may store for an attachment.

  | 
| [__()](https://developer.wordpress.org/reference/functions/__/)`wp-includes/l10n.php` |

Retrieves the translation of $text.

  | 
| [WP_Error::__construct()](https://developer.wordpress.org/reference/classes/wp_error/__construct/)`wp-includes/class-wp-error.php` |

Initializes the error.

  |

[Show 1 more](https://developer.wordpress.org/reference/classes/wp_rest_attachments_controller/validate_sub_size_provenance/?output_format=md#)
[Show less](https://developer.wordpress.org/reference/classes/wp_rest_attachments_controller/validate_sub_size_provenance/?output_format=md#)

| Used by | Description | 
| [WP_REST_Attachments_Controller::finalize_item()](https://developer.wordpress.org/reference/classes/wp_rest_attachments_controller/finalize_item/)`wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php` |

Finalizes an attachment after client-side media processing.

  |

## 󠀁[Changelog](https://developer.wordpress.org/reference/classes/wp_rest_attachments_controller/validate_sub_size_provenance/?output_format=md#changelog)󠁿

| Version | Description | 
| [7.1.0](https://developer.wordpress.org/reference/since/7.1.0/) | Introduced. |

## User Contributed Notes

You must [log in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Fclasses%2Fwp_rest_attachments_controller%2Fvalidate_sub_size_provenance%2F)
before being able to contribute a note or feedback.