# (Beginner) Single entry read permission

**URL:** <https://discourse.getcockpit.com/t/beginner-single-entry-read-permission/2195>\
**Category:** Support\
**Created:** [December 17, 2021, 12:53pm UTC](https://discourse.getcockpit.com/t/beginner-single-entry-read-permission/2195 "2021-12-17T12:53:16Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![designstorming](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/designstorming/32/992_2.png) [@designstorming](https://discourse.getcockpit.com/u/designstorming)\
**Post date:** [December 17, 2021, 12:53pm UTC](https://discourse.getcockpit.com/t/beginner-single-entry-read-permission/2195/1 "2021-12-17T12:53:16Z")

</div>

Hi 👋

To get on the point, I am having difficulties understanding how UI permissions work.  
I created an user and assigned it to the “moderator” group. Took its api key and I am able to list the collection via REST (fetch in javascript). But I cannot fetch a single entry as it throws me 401.

I’ve created `config/config.yaml` with content:

```auto
groups:
  moderator:
    admin: false
    cockpit:
      accounts: false
      finder: false
      rest: false
      info: false
      unlockresources: false
      webhooks: false
      backend: false
    collections:
      create: false
      delete: false
      manage: false
    posts:
      entries_create: true
      entries_view: true
      entries_edit: true
      entries_delete: false

```

- **moderator** is group
- **posts** - is the collection to manage

and have this on UI side:

 ![Screenshot 2021-12-17 at 13.43.44](https://canada1.discourse-cdn.com/flex030/uploads/getcockpit/original/1X/68b00ec6fcb65da899caccaf82cb3475473079d1.png)

Initially everything is off (red toggle - which is OK) and I don’t have additional scripts in any of the fields below (for read, create, etc.).  
Now, If I turn on _View Entries_ in group (like on screenshot) I still cannot get a single entry data from api… at least not until I turn on the same option in “Public” section (which I don’t want). How can I solve this?

Thanks in advace \<3

---

<div class="post-metadata">

**Author:** ![serjoscha87](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/serjoscha87/32/151_2.png) [@serjoscha87](https://discourse.getcockpit.com/u/serjoscha87)\
**Post date:** [December 19, 2021, 6:58pm UTC](https://discourse.getcockpit.com/t/beginner-single-entry-read-permission/2195/2 "2021-12-19T18:58:44Z")

</div>

When you are using the groups addon you don’t need to do manual changes to the config.yaml.

Everything according to groups can be done directly through the UI

---

<div class="post-metadata">

**Author:** ![designstorming](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/designstorming/32/992_2.png) [@designstorming](https://discourse.getcockpit.com/u/designstorming)\
**Post date:** [December 20, 2021, 10:26am UTC](https://discourse.getcockpit.com/t/beginner-single-entry-read-permission/2195/3 "2021-12-20T10:26:03Z")

</div>

I reinstalled the add-on and cleared the config.yaml (now is empty), but still having the same issue. I am really getting frustrated for not being able to resolve this ☹  
Moderator has the access rights for entries in this collection.

For not being able to upload screenshots in comment, posting text version:

```nohighlight
Settings -> Groups -> Moderator -> Edit
Generic - All OFF
Cockpit - All OFF
Collections - All OFF
Singletons - All OFF
Forms - All OFF

Collections -> (collection -> Edit) -> Permissions
Public
  Collection - All OFF
  Entries - All OFF
Moderator
  Edit collection - All OFF
  Entries
    View - ON
    Edit - ON
    Create - ON
    Delete - OFF

```

Response Code / API endpoint  
200 → `http://localhost:3000/api/collections/entries/<COLLECTION_NAME>`  
401 → `http://localhost:3000/api/collections/entry/<COLLECTION_NAME>/<ID>`

---

<div class="post-metadata">

**Author:** ![designstorming](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/designstorming/32/992_2.png) [@designstorming](https://discourse.getcockpit.com/u/designstorming)\
**Post date:** [December 30, 2021, 5:48pm UTC](https://discourse.getcockpit.com/t/beginner-single-entry-read-permission/2195/4 "2021-12-30T17:48:42Z")

</div>

Never mind. I migrated to **strapijs**.

---

<div class="post-metadata">

**Author:** ![creativeplusplus](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/creativeplusplus/32/844_2.png) [@creativeplusplus](https://discourse.getcockpit.com/u/creativeplusplus)\
**Post date:** [January 19, 2022, 3:13am UTC](https://discourse.getcockpit.com/t/beginner-single-entry-read-permission/2195/5 "2022-01-19T03:13:16Z")

</div>

for single entries but use filter

`http://localhost:3000/api/collections/get/products?token=MODERATORTOKEN&filter[slug]=slug_name`

it works with your group settings above