I'm using jsonapi for a headless approach, and need to return a 403 for certain resources if they don't have the permission to view them. Currently this isn't possible using the module - instead the entities they don't have access to are filtered out of the results which is undesirable.
This issue exists with a solution, but unfortunately it's very out of date and I can't seem to wrangle it enough to get it to work with the newest version. I have been extensively searching for how to alter access checks for existing routes, but I only find articles on how to do do this on routes you define yourself.
I would post an issue on the module page itself, but this is quite urgent, and hopefully I can get some quick answers here!
Thanks in advance.