Why do I need so extensive permissions for getting event participant via API?

Question

I'm trying to get participant info via CiviCRM API like this:

civicrm_api('Participant', 'get', 
   array(
      'version' => 3,
      'sequential' => 1,
      'contact_id' => $contact_id,
      'event_id' => $event_id
   )
);

but get the following error:

API permission check failed for Event/get call; insufficient permission: require access CiviCRM and access CiviEvent and view event info

I need to allow unauthorized users to access CiviCRM ("Master control for access to the main CiviCRM backend and API") and CiviEvent ("Create events, view all events, and view participant records (for visible contacts)") to solve this. Aren't those permissions to extensive, just to get some info about a participant? Or am I doing something wrong?

I'm using CiviCRM 4.7.23. I did not get this error in 4.7.14.

EDIT: I do not have to set these permissons to create a participant via API (which is OK). So I think there is definitely something wrong here.

Answer 1

I'm not sure what context you are doing this in, but since you are calling the API from php, you can pass in the param 'check_permissions' => FALSE to bypass the ACLs for the logged in user. This is useful when you know you want to get something from the api that the logged in user wouldn't normally be able to access. Just be careful!