How do I control permissions for API4 calls?



The API kernel broadcasts an authorise event.

Core permission check listener

The main API permission check subscriber will respond to the event by:

$apiRequest = $event->getApiRequest();   
if ($apiRequest['version'] < 4) { /* blah */ }
elseif ($apiRequest['version'] == 4) {      
  if (!$apiRequest->getCheckPermissions()) {

Adding your own listener

If the core logic doesn't meet your needs, it is possible to get the symfony event dispatcher service and add either a listener (for single events) or a subscriber (for multiple events).

For example, to add a subscriber:

$subscriber = new MySubscriberClass();            

When your listener/subscriber is called, then call the $event->getApiRequest() to find out the parameters you are being asked to authorise. If the event should be authorised then call $event->authorize().

SQL clauses

For actions based on get(), the selectQuery->getAclClause() method will call $baoName::getSelectWhereClause($tableAlias) to add a where clause.

It doesn't seem possible currently to apply differing ACL logic depending on the action with this method.

  • 2
    Excellent, thanks for documenting this. One caveat, the api4 is currently unstable and by the time it's released this information may be out-of-date.
    – Coleman
    Mar 12 '17 at 0:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.