I'm using jsonapi for a headless approach, and need to return a 403 for certain resources if they don't have the permission to view them. Currently this isn't possible using the module - instead the entities they don't have access to are filtered out of the results which is undesirable.

This issue exists with a solution, but unfortunately it's very out of date and I can't seem to wrangle it enough to get it to work with the newest version. I have been extensively searching for how to alter access checks for existing routes, but I only find articles on how to do do this on routes you define yourself.

I would post an issue on the module page itself, but this is quite urgent, and hopefully I can get some quick answers here!

Thanks in advance.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.