Is it possible to skip api key check at Relationships delete? We'd like to create one-click link for altering Contact, where users of certain Drupal Role should be able to click "Resign" link and all magic happens behind the scenes. Since there are a lot (really) users of acting role, playing with individual user api key(s), described here http://wiki.civicrm.org/confluence/display/CRMDOC/REST+interface#RESTinterface-CreatingAPIkeysforusers , doesn't sound like a good idea. So, are there something like "skip_key_check" for such a cases? Here's a piece of code currently being used:

CRM.api3('Contact', 'create', {
  "contact_type": "Individual",
  "id": key,
  "is_deceased": 1,
      "custom_197": 0,
    // Relationships part - this is here  api key is being asked
    'api.Relationship.create': { 
       "id": value.rel_ID , 
       "contact_id_a" : value.cont_A, 
       "contact_id_b" : value.cont_B,   
       "relationship_type_id" : value.relationship_type_ID,  
       "end_date": yestrDate,
        "is_active": 0
        // Would be nice to have "skip_permissions_check": 1, here

1 Answer 1


you seem to me mixing two related but different concepts:

  • the REST API, that's an interface to connect to Civi, mostly from external servers (eg another application). In principle, the api_keys and server key shouldn't be visible to the end user but stored in a configuration setting somewhere.
  • the ajax API, that's how a user interact with civicrm to avoid to reload the page completely. This one doesn't need the api_key, as it relies on the user authentication to know what is allowed

In both case, it's not possible to bypass the permissions from an external call directly, it would defy the purpose of having a permission system in the first place ;)

What I would suggest you to do is to write a simple civicrm extension that offers a "member.resign" API and a new "quiter" permission (name to be improved ;) and configure the api so it's only the quiters that can resign.

your api can then call the apis to remove the relationship or whatever else you want to do, and can have the skip_permissions parameter

Then you simply have to grant that permissions to the roles you want in drupal and call your new api CRM.api3('member','resign', {...}) and voila

As an aside, I'm not a lawyer and I don't want to speculate what you do with your contacts that resign, but marking them as deceased is likely to be considered illegal in most jurisdictions ;)

  • Especially since I do not know a lot of deceased people who can actively resign...... Commented Jan 28, 2016 at 15:38
  • well, the one that resign could have his life status changed between the time he clicks on the "resign" button and the time the ajax call hits the server...
    – Xavier
    Commented Jan 28, 2016 at 15:57
  • true enough, but almost as likely as us drinking warm beer? Commented Jan 28, 2016 at 17:13
  • It's about AJAX API than, since it's all supposed to be happened within same domain. And it requires higher permissions level than seems to be logical: now it tells, that ""API permission check failed for RelationshipType\/getlist call; insufficient permission: require administer CiviCRM", but I'm not sure "administer CiviCRM" should be granted to anyone.
    – yurg
    Commented Jan 28, 2016 at 21:06
  • It, so to say, "cured itself" so no additional extensions was needed.
    – yurg
    Commented Jan 29, 2016 at 18:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.