How do the "Permissions" options work?

Support
2

The permissions are for access to the data via the API (and the admin interface) and they are split up into specific “actions”.

Actions and their API endpoints

Collections

  • Edit collection : /api/collections/updateCollection/COLLECTION_NAME + {data: ...}
  • View entries : /api/collections/entries/COLLECTION_NAME / /api/collections/entry/COLLECTION_NAME/ENTRY_ID
  • Edit entries : /api/collections/save/COLLECTION_NAME + {data: {_id: ENTRY_ID, ...}}
  • Create entries : /api/collections/save/COLLECTION_NAME + {data: {_id: undefined, ...}}
  • Delete entries : /api/collections/remove/COLLECTION_NAME + {filter: …}

Singletons

  • Form : admin interface only; no api route - edit the singletons values
  • Edit : admin interface only; no api route - edit the singletons fields
  • Get data (like “view”) : /api/singletons/get/SINGLETON_NAME[/FIELD_NAME]

Public (and other groups)

You can set those permissions on a group level.
By default only the “public” group is shown; as soon as you have other groups specified (in your config.php ) you can set also permissions for those other groups; this also means if you have other groups than admin you are setting the permission for those group-users to access that data via the API as well as the admin interface (if the group has admin interface access).

IMPORTANT: If you enable any of the permissions to be public anyone can execute that action on your API without the need of a token or any authentication. E.g. “view entries” → this will make the whole contents of your collection available to anyone who wants to query it.

Collection rule “scripts”

For “create”, “read”, “update”, “delete” you have the possibility to run the request through an additional script. Those are en/abled below the general permissions.

Those scripts are included when the request is processed and receive a $context of the query (data sent, filters set, etc) and allow you to edit that $context (filter, enhance, validate, …) before it is send to the user (on read) / the database (on write)

See

Content preview

This can be found here Missing documentation of Content Preview