Title: _wp_connectors_rest_settings_dispatch
Published: May 20, 2026

---

# _wp_connectors_rest_settings_dispatch( WP_REST_Response $response, WP_REST_Server $server, WP_REST_Request $request ): 󠀁[WP_REST_Response](https://developer.wordpress.org/reference/classes/wp_rest_response/)󠁿

## In this article

 * [Description](https://developer.wordpress.org/reference/functions/_wp_connectors_rest_settings_dispatch/?output_format=md#description)
 * [Parameters](https://developer.wordpress.org/reference/functions/_wp_connectors_rest_settings_dispatch/?output_format=md#parameters)
 * [Return](https://developer.wordpress.org/reference/functions/_wp_connectors_rest_settings_dispatch/?output_format=md#return)
 * [Source](https://developer.wordpress.org/reference/functions/_wp_connectors_rest_settings_dispatch/?output_format=md#source)
 * [Related](https://developer.wordpress.org/reference/functions/_wp_connectors_rest_settings_dispatch/?output_format=md#related)
 * [Changelog](https://developer.wordpress.org/reference/functions/_wp_connectors_rest_settings_dispatch/?output_format=md#changelog)

[ Back to top](https://developer.wordpress.org/reference/functions/_wp_connectors_rest_settings_dispatch/?output_format=md#wp--skip-link--target)

This function’s access is marked private. This means it is not intended for use 
by plugin or theme developers, only by core. It is listed here for completeness.

Masks and validates connector API keys in REST responses.

## 󠀁[Description](https://developer.wordpress.org/reference/functions/_wp_connectors_rest_settings_dispatch/?output_format=md#description)󠁿

On every `/wp/v2/settings` response, masks connector API key values so raw keys 
are never exposed via the REST API.

On POST or PUT requests, validates each updated key against the provider before 
masking. If validation fails, the key is reverted to an empty string.

## 󠀁[Parameters](https://developer.wordpress.org/reference/functions/_wp_connectors_rest_settings_dispatch/?output_format=md#parameters)󠁿

 `$response`[WP_REST_Response](https://developer.wordpress.org/reference/classes/wp_rest_response/)
required

The response object.

`$server`[WP_REST_Server](https://developer.wordpress.org/reference/classes/wp_rest_server/)
required

The server instance.

`$request`[WP_REST_Request](https://developer.wordpress.org/reference/classes/wp_rest_request/)
required

The request object.

## 󠀁[Return](https://developer.wordpress.org/reference/functions/_wp_connectors_rest_settings_dispatch/?output_format=md#return)󠁿

 [WP_REST_Response](https://developer.wordpress.org/reference/classes/wp_rest_response/)
The modified response with masked/validated keys.

## 󠀁[Source](https://developer.wordpress.org/reference/functions/_wp_connectors_rest_settings_dispatch/?output_format=md#source)󠁿

    ```php
    function _wp_connectors_rest_settings_dispatch( WP_REST_Response $response, WP_REST_Server $server, WP_REST_Request $request ): WP_REST_Response {
    	if ( '/wp/v2/settings' !== $request->get_route() ) {
    		return $response;
    	}

    	$data = $response->get_data();
    	if ( ! is_array( $data ) ) {
    		return $response;
    	}

    	$is_update = 'POST' === $request->get_method() || 'PUT' === $request->get_method();

    	foreach ( wp_get_connectors() as $connector_id => $connector_data ) {
    		$auth = $connector_data['authentication'];
    		if ( 'api_key' !== $auth['method'] || empty( $auth['setting_name'] ) ) {
    			continue;
    		}

    		$setting_name = $auth['setting_name'];
    		if ( ! array_key_exists( $setting_name, $data ) ) {
    			continue;
    		}

    		$value = $data[ $setting_name ];

    		// On update, validate AI provider keys before masking.
    		// Non-AI connectors accept keys as-is; the service plugin handles its own validation.
    		if ( $is_update && is_string( $value ) && '' !== $value && 'ai_provider' === $connector_data['type'] ) {
    			if ( true !== _wp_connectors_is_ai_api_key_valid( $value, $connector_id ) ) {
    				update_option( $setting_name, '' );
    				$data[ $setting_name ] = '';
    				continue;
    			}
    		}

    		// Mask the key in the response.
    		if ( is_string( $value ) && '' !== $value ) {
    			$data[ $setting_name ] = _wp_connectors_mask_api_key( $value );
    		}
    	}

    	$response->set_data( $data );
    	return $response;
    }
    ```

[View all references](https://developer.wordpress.org/reference/files/wp-includes/connectors.php/)
[View on Trac](https://core.trac.wordpress.org/browser/tags/7.0/src/wp-includes/connectors.php#L522)
[View on GitHub](https://github.com/WordPress/wordpress-develop/blob/7.0/src/wp-includes/connectors.php#L522-L565)

## 󠀁[Related](https://developer.wordpress.org/reference/functions/_wp_connectors_rest_settings_dispatch/?output_format=md#related)󠁿

| Uses | Description | 
| [_wp_connectors_is_ai_api_key_valid()](https://developer.wordpress.org/reference/functions/_wp_connectors_is_ai_api_key_valid/)`wp-includes/connectors.php` |

Checks whether an API key is valid for a given provider.

  | 
| [_wp_connectors_mask_api_key()](https://developer.wordpress.org/reference/functions/_wp_connectors_mask_api_key/)`wp-includes/connectors.php` |

Masks an API key, showing only the last 4 characters.

  | 
| [wp_get_connectors()](https://developer.wordpress.org/reference/functions/wp_get_connectors/)`wp-includes/connectors.php` |

Retrieves all registered connectors.

  | 
| [update_option()](https://developer.wordpress.org/reference/functions/update_option/)`wp-includes/option.php` |

Updates the value of an option that was already added.

  |

[Show 1 more](https://developer.wordpress.org/reference/functions/_wp_connectors_rest_settings_dispatch/?output_format=md#)
[Show less](https://developer.wordpress.org/reference/functions/_wp_connectors_rest_settings_dispatch/?output_format=md#)

## 󠀁[Changelog](https://developer.wordpress.org/reference/functions/_wp_connectors_rest_settings_dispatch/?output_format=md#changelog)󠁿

| Version | Description | 
| [7.0.0](https://developer.wordpress.org/reference/since/7.0.0/) | Introduced. |

## User Contributed Notes

You must [log in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Ffunctions%2F_wp_connectors_rest_settings_dispatch%2F)
before being able to contribute a note or feedback.