WordPress API – Blog Post Review without admin login

The WP REST API allows you to query posts by post type (API endpoint), and filter by post status.
Check documentation about listing posts.

status: Limit result set to posts assigned one or more statuses.

type: Type of Post for the object.

https://example.com/wp-json/wp/v2/posts?status=draft

You can use WP post statuses like publish, future, draft, pending, private, or custom statuses you made.

Problem is that private and draft post statuses are protected: those are not public and cannot be queried without authentication. I just tried and indeed, I can query public posts, but I cannot query private and draft posts without my API request being authenticated.

So what you could do:

1. Authenticate users to the API so they can query draft and private posts

2. Create a custom post status that is public (public, publicly_queryable and exclude_from_search parameters), so it can be queried without authentication from the API. This way you keep private and draft statuses secured like WP wants it. And use another for "drafts that are public".

3. You can change the "public" status of the private and draft post statuses, so they can be queried without authentication (see example). Double-check security concerns if doing so, as it would change the WP core status design.