Restful permission is required

Question

I've created a @RestResource plugin to provide a REST endpoint to get some data, but when I try a GET from Postman it shows this error:

{ "message": "The 'restful get ez_share_document_resource' permission is required." }

I thought it was because I need to add something else, so I decided to enable the Watchdog database log REST resource to prove it, but I got the same error:

"message": "The 'restful get dblog' permission is required."

Rest module has set bc_entity_resource_permissions as false.

This is the annotation of the plugin.

/**
 * Provides a resource to get view modes by entity and bundle.
 *
 * @RestResource(
 *   id = "ez_share_document_resource",
 *   label = @Translation("Ez share document resource"),
 *   uri_paths = {
 *     "canonical" = "/ezshare/{ezshare_id}"
 *   }
 * )
 */
class EzShareDocumentResource extends ResourceBase {

And this is my get method:

public function get($ezshare_id = NULL) {
    if ($ezshare_id) {
      $record = ['It Works!!'];
      if (!empty($record)) {
        return new ResourceResponse($record, 200);
      }

      throw new NotFoundHttpException($this->t('EzShare doc with ID @id was not found', ['@id' => $ezshare_id]));
    }

    throw new BadRequestHttpException($this->t('No EzShare doc ID was provided'));
  }

Drupal core is recently updated to 8.8.1.

Answer 1

Finally, I was able to solve this issue adding the method permission to the RestResource plugin like so:

public function permissions() {
  return [];
}

Answer 2

The default permissions() method creates a permission per method

In ResourceBase

/**
* Implements ResourceInterface::permissions().
*
* Every plugin operation method gets its own user permission. Example:
* "restful delete entity:node" with the title "Access DELETE on Node
* resource".
*/

Shown in admin/people/permissions

Everything else being equal anonymous can be given access (or a specific role).

Clearing permissions doesn't open access.

Check the REST configuration. Either via configuration synchronisation or REST UI. Install the Rest UI module and check that an authentication provider is installed (OP Basic Auth). The permissions can be configured from the Rest UI interface

Some authentication methods also require access. Check in the network monitor in the browser. With JWT for example, a request for an expired token is required first. If this is denied, or fails it is a problem with the authentication provider.