API ACL

Define ACL Resources

<!-- etc/acl.xml -->
<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:noNamespaceSchemaLocation="urn:magento:framework:Acl/etc/acl.xsd">
    <acl>
        <resources>
            <resource id="Magento_Backend::admin">
                <resource id="Magento_Backend::stores">
                    <resource id="Magento_Backend::stores_settings">
                        <resource id="Magento_Backend::config">
                            <resource id="Vendor_Module::config" title="Vendor Module Settings"/>
                        </resource>
                    </resource>
                </resource>
            </resource>
        </resources>
    </acl>
</config>

API ACL Resources

<!-- etc/webapi.xml -->
<resources>
    <resource ref="anonymous"/>
</resources>

<resources>
    <resource ref="Magento_Customer::customer"/>
</resources>

<resources>
    <resource ref="Magento_Catalog::products"/>
</resources>

Resource References

Admin Token

# Get admin token
curl -X POST 'https://store.com/rest/V1/integration/admin/token' \
     -H 'Content-Type: application/json' \
     -d '{
         "username": "admin",
         "password": "admin123"
     }'

# Response
{
    "token": "abc123..."
}

# Use token
curl -X GET 'https://store.com/rest/V1/products' \
     -H 'Authorization: Bearer abc123...'

Customer Token

# Get customer token
curl -X POST 'https://store.com/rest/V1/integration/customer/token' \
     -H 'Content-Type: application/json' \
     -d '{
         "username": "customer@example.com",
         "password": "password123"
     }'

# Use token
curl -X GET 'https://store.com/rest/V1/customers/me' \
     -H 'Authorization: Bearer customer_token'

Integration Token

# Create integration in admin
# System > Integrations > Add New Integration

# Get token from integration
# Use for API access

Admin Access

<!-- Only admin users -->
<resources>
    <resource ref="Magento_Backend::admin"/>
</resources>

// Admin token required
curl -H 'Authorization: Bearer admin_token'

Customer Access

<!-- Authenticated customers -->
<resources>
    <resource ref="Magento_Customer::customer"/>
</resources>

// Customer token required
curl -H 'Authorization: Bearer customer_token'

Guest Access

<!-- Public access -->
<resources>
    <resource ref="anonymous"/>
</resources>

// No token required
curl 'https://store.com/rest/V1/products'

Combined Access

<!-- Multiple access levels -->
<resources>
    <resource ref="anonymous"/>
    <resource ref="Magento_Customer::customer"/>
</resources>

Resource Tree

Magento_Backend::admin
├── Magento_Backend::stores
│   ├── Magento_Backend::stores_settings
│   │   └── Magento_Backend::config
├── Magento_Catalog::products
├── Magento_Customer::customer
└── Vendor_Module::items
    ├── Vendor_Module::items_view
    ├── Vendor_Module::items_edit
    └── Vendor_Module::items_delete

Custom ACL Resource

<!-- etc/acl.xml -->
<resources>
    <resource id="Magento_Backend::admin">
        <resource id="Vendor_Module::items" title="Items">
            <resource id="Vendor_Module::items_view" title="View Items"/>
            <resource id="Vendor_Module::items_edit" title="Edit Items"/>
            <resource id="Vendor_Module::items_delete" title="Delete Items"/>
        </resource>
    </resource>
</resources>

Use in webapi.xml

<route url="/vendor/items/:id" method="get">
    <service class="Vendor\Module\Api\ItemInterface" method="getById"/>
    <resources>
        <resource ref="Vendor_Module::items_view"/>
    </resources>
</route>

<route url="/vendor/items/:id" method="put">
    <service class="Vendor\Module\Api\ItemInterface" method="update"/>
    <resources>
        <resource ref="Vendor_Module::items_edit"/>
    </resources>
</route>

Admin Role Configuration

Admin > System > Permissions > Roles
1. Add new role
2. Set role resources:
   - Vendor Module
     - Items
       - View Items ✓
       - Edit Items ✓
       - Delete Items ✗
3. Save role
4. Assign to users

Permission Check in Code

<?php
namespace Vendor\Module\Api;

class ItemRepository implements ItemInterface
{
    public function __construct(
        private \Magento\Framework\Acl\ResolverInterface $aclResolver,
        private \Magento\Framework\Authorization\PolicyInterface $authPolicy,
    ) {
    }
    
    public function getById(int $id): ItemDataInterface
    {
        if (!$this->authPolicy->isAllowed('Vendor_Module::items_view')) {
            throw new \Magento\Framework\Exception\AuthorizationException(
                __('Access denied')
            );
        }
        
        // Get item logic
    }
}