1.2.0

Resizable panels

• The sidebar, request builder, and response panels can be resized by dragging either divider, reset with a double-click, and collapsed entirely with the toggle on each divider.
• Widths and collapse state persist in localStorage and are applied before first paint, so the layout no longer jumps on load.
• Dividers are keyboard-operable (arrow keys, Shift for 1px steps, Home/End) and expose the ARIA separator pattern.
• Collapsed panels are marked inert so they leave the tab order and the accessibility tree; collapse toggles are always visible on touch devices, and desktop panel state is torn down below the 900px stacking breakpoint.

JSON response viewer

• The response Body pane now offers Tree, Pretty, and Raw views. The tree builds children lazily and chunks very large containers, so big payloads stay interactive.
• Raw shows the exact bytes the server sent, so a malformed JSON body displays instead of failing.
• A filter box accepts a JSONPath subset — keys, indices, slices, wildcards, recursive descent, and comparison filters with &&/||, regex matches, and key-existence tests. Syntax errors are reported rather than silently matching nothing.
• The tree follows the ARIA tree pattern with a roving tabindex: one tab stop regardless of row count, with arrow-key navigation, * to expand siblings, and c to copy a row's JSONPath.
• Fixed syntaxHighlight() escaping the JSON before matching, which left strings and keys uncoloured in the Pretty view.
• Copy actions now report failure explicitly instead of failing silently when the Clipboard API is unavailable or denied; the tree also announces the copied path through its live region.

Fixes and hardening

• Path parameters are encoded so slashes stay literal, letting routes such as /wp/v2/plugins/jetpack/jetpack resolve correctly.
• . and .. segments in path parameters are rejected, preventing a value from resolving the request to a different endpoint than the one displayed.
• Request build failures are now distinguished from transport failures instead of being reported as connection errors.
• Argument name, id, and type are escaped in request field attribute positions.
• Generated cURL commands use POSIX-safe quoting and keep the Authorization header on GET requests.
• The playground page sends nocache_headers() so its embedded nonce is never cached by an intermediary.
• Route parameters written as nested regex groups (themes, plugins) are parsed with depth counting, so regex residue no longer leaks into the displayed route and request URL.
• The Send button keeps its icon while its label changes.
• The plugin header now declares Requires at least: 6.0 and Requires PHP: 8.0, so WordPress blocks activation on unsupported versions instead of failing at runtime.

Upgrade notes

Minor release — no public surface changed. The /rest-api-playground/ slug, the /wp-json/rest-playground/v1/routes endpoint, the manage_options capability gate, and the sessionStorage auth key are all unchanged; wp-rest-playground-layout is a new localStorage key.

Requires PHP: 8.0 in the plugin header now blocks activation on PHP 7.x, where the plugin previously installed and then failed at runtime in the routes endpoint.

Full changelog: 1.1.0...1.2.0