My REST API call returns data fine as long as the user has 'view all contacts' permission. But if I turn that off and instead grant the user access to a particular group via an ACL, I get nothing. I've confirmed that the user can see the relevant data through the UI.

Should that work? Or are ACLs not taken into account by the REST API?

Using WordPress and Civi 4.5.8.

Update 1: this issue on the forum suggests it might not be WordPress specific.

Update 2: Just to clarify exactly what I'm doing, here's the relevant part of the URL:


I can get the data I want by using the API key of an admin, or if a non-admin has 'View all contacts' permission. But I get no results if the non-admin lacks this permission and only has access via an ACL. (If I change the API key I get an authentication error, so I'm confident that's correct.)


2 Answers 2


When the Contact Get REST api is triggered, I can see that the permission clause for the ACL is being generated from the whereClause() funcion of CRM_ACL_API. Here a contactId(previously passed as NULL) is fetched from the session (logged in user id) and the contact from api_key is actually not taken into account. Hence a 0 is set for ContactId and ACL permissions are not respected.

  • Exactly what I needed to know - thanks! Now to see if I can fix it... (will assign bounty as soon as I can - StackExchange says I need to wait six hours) Aug 11, 2015 at 11:12

I tested this locally & it worked fine - but looking at the wordpress code the signature of the loadBootStrap function does not match the signature of drupal (which works).

I expect it's not responding correctly to

  CRM_Utils_System::loadBootStrap(array('uid' => $uid), TRUE, FALSE);


return $config->userSystem->loadBootStrap($params, $loadUser, $throwError, $realPath);

passes in an array but WP seems to be unable to cope with that

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.