Looking at search.routing.yml, I noticed it contains the following code.

  path: '/admin/config/search/pages/manage/{search_page}/enable'
    _controller: '\Drupal\search\Controller\SearchController::performOperation'
    op: 'enable'
    _entity_access: 'search_page.update'
    _csrf_token: 'TRUE'

  path: '/admin/config/search/pages/manage/{search_page}/disable'
    _controller: '\Drupal\search\Controller\SearchController::performOperation'
    op: 'disable'
    _entity_access: 'search_page.disable'
    _csrf_token: 'TRUE'

While it's clear that the first part of the _entity_access value is the ID of the configuration entity used in the annotation for the class implementing it, I don't understand what I can use as part after the dot. Is it restricted to a set of values (e.g. add, update, use, delete), or is it a value the access controller class for that entity handle?

1 Answer 1


According to the Drupal 8 documentation:

_entity_access: In the case where an entity is part of a route, can check a certain access level before granting access (e.g., _entity_access: 'node.view').

The part after the dot is the type of access you want to check on the entity. To find the full set of possible values, you have to look at the code of the entity (in your case, in \Drupal\search\Entity\SearchPage). The default possible values are view, update, delete, create. Entities implemented by SearchPage can also be disabled and enabled. (See search.routing.yml and SearchController.)

See also EntityAccessCheck::access().


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.