Register routes with register_rest_route(). The permission_callback is required — set it to __return_true only when the route is genuinely public.
For privileged operations, check capabilities with current_user_can() and validate nonces from JS-originated requests via wp_verify_nonce().
Use the args array to declare and sanitize parameters. The REST controller will reject malformed input before your callback runs.