#How to make a collection Public through the REST API?
8 messages ยท Page 1 of 1 (latest)
Alright, thank you for the answer. Do you know if I can restrict users to be able to CRUD their own items only?
For example, I have a Client role and a Stores collection. I created a Client_ID field in the collection, with a relationship to the Client
Is it possible to allow that client only, to read their own store through the REST API and no one else?
Yes this type of thing is possible through permissions.
Directus offers an extremely granular, yet easy to configure permissions system. When you create a role, all permissions are turned off by default.
You'd define a Custom Permission for it.
Good to know thanks. Although I still haven't managed to make it work. I have assigned a client_id to a Store collection which contains the directus_user id to connect them. I now login correctly using Postman by doing a POST request to /auth/login using the cookie mode and I get the cookie back. I now want to do a GET requst to https://[appid].directus.app/items/Store and view my own Store only.
I have not been able to figure out what the filter is supposed to be. I have tried client_id equals $CURRENT_USER, client_id->email equals $CURRENT_USER.email and other derivatives with no success so far. I still get FORBIDDEN.
What is the payload of the REST request used by the PUBLIC API user which I would need to compare against? What is the filter that I would need to use to restrict access to one's own items?