I'm working on converting an app that was built against the REST APIv3 to use REST APIv4, and I've found the APIv4 documentation quite lacking.
Through trial and error, I've determined that Authentication Guard has to be effectively disabled (by having it configured with no options in the Authentication Extension) for CiviCRM to authenticate my call. All other options I've tried return 401 Unauthorized. (Note to others: Make sure you're using a recent version of CiviCRM. While APIv4 has existed for quite some time, the REST part of it appears to have been added around v5.47.)
There are two options that can be enabled, that are not mutually exclusive:
- User Permission. What permission is this, and how do you add it?
- Site Key. How do you include the Site Key in your APIv4 REST call? The format used for APIv3 does not appear to work.
My question is: How do you leverage Authentication Guard in your APIv4 calls?