I am writing an extension which uses a CRM.api3 call in javascript on the contribution page. However, the link that is generated is lacking the "administrator" part. For example,

The API call to StateProvince generates this: http://localhost:81/example.org/index.php?option=com_civicrm&task=civicrm/ajax/rest&entity=StateProvince&action=get&json=%7B%22sequential%22%3A1%2C%22id%22%3A%221042%22%7D

That gives a Internal Server Error 500 message.

However if I add "administrator" to the link: http://localhost:81/example.org/administrator/index.php?option=com_civicrm&task=civicrm/ajax/rest&entity=StateProvince&action=get&json=%7B%22sequential%22%3A1%2C%22id%22%3A%221042%22%7D

it asks the user to log-in and then works fine. How can I allow my extension's javascript to call the StateProvince api Get method without making the user log in?

Below is my code:

var myStateInfo = '';
CRM.api3('StateProvince', 'get', { "sequential": 1, "id": myStateId }).done(function(result) { 
    myStateInfo = result;
  • 1
    Try using ‘check_permissions = false’ as a parameter in the API. Sep 24 '17 at 9:49

You probabky have to give anonymous users the permission "CiviCRM: access AJAX API".

  • That would work, but is there anyway to not give them complete access to the API? Would that let anyone run any CiviCRM API call?
    – ermSO
    Oct 20 '17 at 13:25
  • The permission only allows accessing the API - what they can do with it still depends on the other permissions they do (not) have. For example if anonymous users are not allowed to see or edit contacts, they won't be allowed to do that via the API either.
    – Fabian
    Oct 23 '17 at 5:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.