Title: WP_REST_Comments_Controller::get_items_permissions_check
Published: December 6, 2016
Last modified: August 20, 2026

---

# WP_REST_Comments_Controller::get_items_permissions_check( WP_REST_Request $request ): true|󠀁[WP_Error](https://developer.wordpress.org/reference/classes/wp_error/)󠁿

## In this article

 * [Parameters](https://developer.wordpress.org/reference/classes/wp_rest_comments_controller/get_items_permissions_check/?output_format=md#parameters)
 * [Return](https://developer.wordpress.org/reference/classes/wp_rest_comments_controller/get_items_permissions_check/?output_format=md#return)
 * [Source](https://developer.wordpress.org/reference/classes/wp_rest_comments_controller/get_items_permissions_check/?output_format=md#source)
 * [Related](https://developer.wordpress.org/reference/classes/wp_rest_comments_controller/get_items_permissions_check/?output_format=md#related)
 * [Changelog](https://developer.wordpress.org/reference/classes/wp_rest_comments_controller/get_items_permissions_check/?output_format=md#changelog)

[ Back to top](https://developer.wordpress.org/reference/classes/wp_rest_comments_controller/get_items_permissions_check/?output_format=md#wp--skip-link--target)

Checks if a given request has access to read comments.

## 󠀁[Parameters](https://developer.wordpress.org/reference/classes/wp_rest_comments_controller/get_items_permissions_check/?output_format=md#parameters)󠁿

 `$request`[WP_REST_Request](https://developer.wordpress.org/reference/classes/wp_rest_request/)
required

Full details about the request.

## 󠀁[Return](https://developer.wordpress.org/reference/classes/wp_rest_comments_controller/get_items_permissions_check/?output_format=md#return)󠁿

 true|[WP_Error](https://developer.wordpress.org/reference/classes/wp_error/) True
if the request has read access, error object otherwise.

## 󠀁[Source](https://developer.wordpress.org/reference/classes/wp_rest_comments_controller/get_items_permissions_check/?output_format=md#source)󠁿

    ```php
    public function get_items_permissions_check( $request ) {
    	$is_note          = 'note' === $request['type'];
    	$is_edit_context  = 'edit' === $request['context'];
    	$protected_params = array( 'author', 'author_exclude', 'author_email', 'type', 'status' );
    	$forbidden_params = array();

    	if ( ! empty( $request['post'] ) ) {
    		foreach ( (array) $request['post'] as $post_id ) {
    			$post = get_post( $post_id );

    			if ( ! empty( $post_id ) && $post && ! $this->check_read_post_permission( $post, $request ) ) {
    				return new WP_Error(
    					'rest_cannot_read_post',
    					__( 'Sorry, you are not allowed to read the post for this comment.' ),
    					array( 'status' => rest_authorization_required_code() )
    				);
    			} elseif ( 0 === $post_id && ! current_user_can( 'moderate_comments' ) ) {
    				return new WP_Error(
    					'rest_cannot_read',
    					__( 'Sorry, you are not allowed to read comments without a post.' ),
    					array( 'status' => rest_authorization_required_code() )
    				);
    			}

    			if ( $post && $is_note && ! $this->check_post_type_supports_notes( $post->post_type ) ) {
    				if ( current_user_can( 'edit_post', $post->ID ) ) {
    					return new WP_Error(
    						'rest_comment_not_supported_post_type',
    						__( 'Sorry, this post type does not support notes.' ),
    						array( 'status' => 403 )
    					);
    				}

    				foreach ( $protected_params as $param ) {
    					if ( 'status' === $param ) {
    						if ( 'approve' !== $request[ $param ] ) {
    							$forbidden_params[] = $param;
    						}
    					} elseif ( 'type' === $param ) {
    						if ( 'comment' !== $request[ $param ] ) {
    							$forbidden_params[] = $param;
    						}
    					} elseif ( ! empty( $request[ $param ] ) ) {
    						$forbidden_params[] = $param;
    					}
    				}
    				return new WP_Error(
    					'rest_forbidden_param',
    					/* translators: %s: List of forbidden parameters. */
    					sprintf( __( 'Query parameter not permitted: %s' ), implode( ', ', $forbidden_params ) ),
    					array( 'status' => rest_authorization_required_code() )
    				);
    			}
    		}
    	}

    	// Re-map edit context capabilities when requesting `note` for a post.
    	if ( $is_edit_context && $is_note && ! empty( $request['post'] ) ) {
    		foreach ( (array) $request['post'] as $post_id ) {
    			if ( ! current_user_can( 'edit_post', $post_id ) ) {
    				return new WP_Error(
    					'rest_forbidden_context',
    					__( 'Sorry, you are not allowed to edit comments.' ),
    					array( 'status' => rest_authorization_required_code() )
    				);
    			}
    		}
    	} elseif ( $is_edit_context && ! current_user_can( 'moderate_comments' ) ) {
    		return new WP_Error(
    			'rest_forbidden_context',
    			__( 'Sorry, you are not allowed to edit comments.' ),
    			array( 'status' => rest_authorization_required_code() )
    		);
    	}

    	if ( ! current_user_can( 'edit_posts' ) ) {
    		foreach ( $protected_params as $param ) {
    			if ( 'status' === $param ) {
    				if ( 'approve' !== $request[ $param ] ) {
    					$forbidden_params[] = $param;
    				}
    			} elseif ( 'type' === $param ) {
    				if ( 'comment' !== $request[ $param ] ) {
    					$forbidden_params[] = $param;
    				}
    			} elseif ( ! empty( $request[ $param ] ) ) {
    				$forbidden_params[] = $param;
    			}
    		}

    		if ( ! empty( $forbidden_params ) ) {
    			return new WP_Error(
    				'rest_forbidden_param',
    				/* translators: %s: List of forbidden parameters. */
    				sprintf( __( 'Query parameter not permitted: %s' ), implode( ', ', $forbidden_params ) ),
    				array( 'status' => rest_authorization_required_code() )
    			);
    		}
    	}

    	return true;
    }
    ```

[View all references](https://developer.wordpress.org/reference/files/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php/)
[View on Trac](https://core.trac.wordpress.org/browser/tags/7.1/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php#L125)
[View on GitHub](https://github.com/WordPress/wordpress-develop/blob/7.1/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php#L125-L226)

## 󠀁[Related](https://developer.wordpress.org/reference/classes/wp_rest_comments_controller/get_items_permissions_check/?output_format=md#related)󠁿

| Uses | Description | 
| [WP_REST_Comments_Controller::check_post_type_supports_notes()](https://developer.wordpress.org/reference/classes/wp_rest_comments_controller/check_post_type_supports_notes/)`wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php` |

Check if post type supports notes.

  | 
| [WP_REST_Comments_Controller::check_read_post_permission()](https://developer.wordpress.org/reference/classes/wp_rest_comments_controller/check_read_post_permission/)`wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php` |

Checks if the post can be read.

  | 
| [rest_authorization_required_code()](https://developer.wordpress.org/reference/functions/rest_authorization_required_code/)`wp-includes/rest-api.php` |

Returns a contextual HTTP error code for authorization failure.

  | 
| [current_user_can()](https://developer.wordpress.org/reference/functions/current_user_can/)`wp-includes/capabilities.php` |

Returns whether the current user has the specified capability.

  | 
| [__()](https://developer.wordpress.org/reference/functions/__/)`wp-includes/l10n.php` |

Retrieves the translation of $text.

  | 
| [get_post()](https://developer.wordpress.org/reference/functions/get_post/)`wp-includes/post.php` |

Retrieves post data given a post ID or post object.

  | 
| [WP_Error::__construct()](https://developer.wordpress.org/reference/classes/wp_error/__construct/)`wp-includes/class-wp-error.php` |

Initializes the error.

  |

[Show 5 more](https://developer.wordpress.org/reference/classes/wp_rest_comments_controller/get_items_permissions_check/?output_format=md#)
[Show less](https://developer.wordpress.org/reference/classes/wp_rest_comments_controller/get_items_permissions_check/?output_format=md#)

## 󠀁[Changelog](https://developer.wordpress.org/reference/classes/wp_rest_comments_controller/get_items_permissions_check/?output_format=md#changelog)󠁿

| Version | Description | 
| [4.7.0](https://developer.wordpress.org/reference/since/4.7.0/) | Introduced. |

## User Contributed Notes

You must [log in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Fclasses%2Fwp_rest_comments_controller%2Fget_items_permissions_check%2F)
before being able to contribute a note or feedback.