Requests to the REST API will be handled as a logged-out user unless your request is accompanied by a nonce. From the documentation:
For developers making manual Ajax requests, the nonce will need to be passed with each request. The API uses nonces with the action set to wp_rest. These can then be passed to the API via the _wpnonce data parameter (either POST data or in the query for GET requests), or via the X-WP-Nonce header.
You’d first create the nonce and pass it to the script with wp_localize_script():
wp_localize_script( 'my-script', 'MyScript', array(
'nonce' => wp_create_nonce( 'wp_rest' ),
) );
Then, when using jQuery for a request, you set the X-WP-Nonce header to the nonce value:
jQuery.ajax( {
url: url,
data: data,
beforeSend: function( request ) {
request.setRequestHeader( 'X-WP-Nonce', MyScript.nonce );
},
} )
