To get contact data via the API you only need the 'access CiviCRM' permission, as long as you have access to the contact in question somehow (via an ACL or whatever). But to get address data for the same contact you need the 'view all contacts' permission. Is there a reason address data is more locked down? Can I override it?
Our use case is: a third-party website is accessing Civi via the REST API. This website is managed by a third-party, so I don't want to use an API key that gives them full database access. So I've set up a user who only has access to the relevant contacts. I can get the basic contact data fine, but I can't get their addresses without altering this global api permission requirement.
I'm just a bit nervous about changing this in case it's going to open any security holes elsewhere...
Here's the code in question, in CRM/Core/DAO/permissions.php :
// Contact permissions $permissions['contact'] = array( 'create' => array( 'access CiviCRM', 'add contacts', ), 'delete' => array( 'access CiviCRM', 'delete contacts', ), // managed by query object 'get' => array(), 'update' => array( 'access CiviCRM', 'edit all contacts', ), 'getquick' => array( array('access CiviCRM', 'access AJAX API'), ), ); // Contact-related data permissions. // CRM-14094 - Users can edit and delete contact-related objects using inline edit with 'edit all contacts' permission $permissions['address'] = array( 'get' => array( 'access CiviCRM', 'view all contacts', ), 'default' => array( 'access CiviCRM', 'edit all contacts', ), );
Emails, phone numbers, websites, instant messaging etc. all use the same 'view all contacts' requirement.