WooCommerce REST API consumer key missing dedicated read‑only order notes scope

Currently, there is no native method within the WooCommerce REST API to grant a consumer key read-only access to order notes without granting broader order edit capabilities. The API architecture ties order note retrieval to the shop_order capability, which is bundled with edit_shop_orders at the WordPress role level.

The Granularity Gap

The core issue arises because consumer keys inherit the permissions of the WordPress user they are associated with. If a user has a role that allows editing orders, the associated consumer key can perform POST, PUT, PATCH, and DELETE operations on order endpoints. There is no specific read_order_notes scope to decouple this action from the order object itself.

API v3 Roadmap

There is no confirmed information in the WooCommerce REST API v3 roadmap regarding a dedicated, read-only permission for order notes. Until such an update is released, administrators must rely on external workarounds to enforce this restriction.

How to Verify Consumer Key Limits

To verify if a consumer key is truly limited to read-only access in your current environment, follow these steps using a custom WordPress role:

• Create a Custom Role: Use a plugin or custom code to create a role (e.g., "note_reader") that has only the read capability and specifically lacks edit_shop_orders.
• Assign to User: Create a WordPress user assigned to this new role.
• Generate Key: Generate a REST API consumer key with "Read" access linked to this specific user.
• Test Write Access: Use a tool like curl to attempt to update an order note:

  curl -X POST "https://your-store.com/wp-json/wc/v3/orders/123"
    -H "Authorization: Basic ck_KEY:ckk_SECRET" \\n  -H "Content-Type: application/json" \\n  -d '{"notes": [{"note": "Test note"}]}'

  If the API returns a 403 Forbidden, the key is successfully restricted to read-only. If the note updates, the user role still possesses too much privilege.

If you require the key to see only notes and block all other order data, you must implement a custom filter in your functions.php that hooks into the REST_API_init action to strip sensitive fields from the order response for specific roles.