I've created a @RestResource plugin to provide a REST endpoint to get some data, but when I try a GET from Postman it shows this error:

{ "message": "The 'restful get ez_share_document_resource' permission is required." }

I thought it was because I need to add something else, so I decided to enable the Watchdog database log REST resource to prove it, but I got the same error:

"message": "The 'restful get dblog' permission is required."

Rest module has set bc_entity_resource_permissions as false.

This is the annotation of the plugin.

 * Provides a resource to get view modes by entity and bundle.
 * @RestResource(
 *   id = "ez_share_document_resource",
 *   label = @Translation("Ez share document resource"),
 *   uri_paths = {
 *     "canonical" = "/ezshare/{ezshare_id}"
 *   }
 * )
class EzShareDocumentResource extends ResourceBase {

And this is my get method:

public function get($ezshare_id = NULL) {
    if ($ezshare_id) {
      $record = ['It Works!!'];
      if (!empty($record)) {
        return new ResourceResponse($record, 200);

      throw new NotFoundHttpException($this->t('EzShare doc with ID @id was not found', ['@id' => $ezshare_id]));

    throw new BadRequestHttpException($this->t('No EzShare doc ID was provided'));

Drupal core is recently updated to 8.8.1.

  • You have to add the permission to the roles that must have the permission under, /admin/people/permissions.
    – user72672
    Commented Dec 20, 2019 at 14:03
  • Yes, all permissions are enabled for Authenticated users. Commented Dec 20, 2019 at 14:10
  • Do you use cookie or 'simple_auth' as authentication?
    – user72672
    Commented Dec 20, 2019 at 14:13
  • Yes, I use Basic Auth, but when I use cookies in the browser it works. The issue is only with Basic Auth. Commented Dec 20, 2019 at 14:17
  • You have to send the Authorization header with in Postman. In postman you can choose to authenticate with basic auth where you enter the username and password.
    – user72672
    Commented Dec 20, 2019 at 14:23

2 Answers 2


Finally, I was able to solve this issue adding the method permission to the RestResource plugin like so:

public function permissions() {
  return [];
  • 2
    Yes! this is the right answer. Also you should add the annotation to your method like this: /** * {@inheritdoc} */ public function permissions() { // permissions are required. return []; } Commented Apr 24, 2021 at 0:39

The default permissions() method creates a permission per method

In ResourceBase

* Implements ResourceInterface::permissions().
* Every plugin operation method gets its own user permission. Example:
* "restful delete entity:node" with the title "Access DELETE on Node
* resource".

Shown in admin/people/permissions

Permissions page entry

Everything else being equal anonymous can be given access (or a specific role).

Clearing permissions doesn't open access.

Check the REST configuration. Either via configuration synchronisation or REST UI. Install the Rest UI module and check that an authentication provider is installed (OP Basic Auth). The permissions can be configured from the Rest UI interface

Rest UI configuration

Some authentication methods also require access. Check in the network monitor in the browser. With JWT for example, a request for an expired token is required first. If this is denied, or fails it is a problem with the authentication provider.

  • It's not so clear with JWT token, can you provide more info ? I'm testing with Postmant, but no matter what I write in the Bearer, I keep getting access to the endpoint.
    – pbonnefoi
    Commented Nov 7, 2023 at 17:17
  • I guess you turn off all access to make sure you are hitting the right end point? If there is full access without a token then it is an access rules problem, not a token problem.
    – Interlated
    Commented Nov 8, 2023 at 4:37
  • Alright, but which access rule ? I haven't done anything specific, it's seems like a cache problem in my case because once it's validated I never go into the EventSubscriber provided by the JWT module
    – pbonnefoi
    Commented Nov 9, 2023 at 9:18
  • You could try rebuilding permission /admin/reports/status/rebuild drupal.stackexchange.com/questions/216940/…
    – Interlated
    Commented Nov 13, 2023 at 22:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.