I am attempting to interact with my CiviCRM backend using the AJAX API. I created a 'contact' page in WordPress, referencing a profile I created solely to load the CiviCRM javascript into my custom page. The template is part of a custom theme I have created from scratch.
To test, I can open the contact page in my browser and drop this into the console:
CRM.api3('Contact', 'create', {
contact_type : 'Individual',
first_name : 'Test',
last_name : 'Aroonie',
email : 'testaroonie@verizonsucks.net',
note : 'Hello I am contacting you thx'
});
This gives me an OK response and creates a new contact as I expect, when I'm logged in to wp-admin. However, when I try this in an incognito window, I get an HTML response saying "You do not have permission to access this page."
I read the permissions documentation, which recommends implementing hook_civicrm_alterAPIPermissions() to override contact-create permission, which I have done in my theme's functions.php. It doesn't look like this hook is being called.
Am I on the right track here? If so, what details have I missed?
functions.phpfile:function allow_public_create_contact($entity, $action, &$params, &$permissions) { if ($entity == 'contact' && $action == 'create') { $permissions['contact']['create'] = array(); } } add_filter('civicrm_alterAPIPermissions', 'allow_public_create_contact', 10, 4);