Web Services API permissions
In Joomla!, the Web Services login by default is restricted to users in the Super Users group. The reason behind this is that, now, the API allows full management of a Joomla! site, so a broader permission range will pose a security risk for lots of sites.
We can change this in the Permissions tab in the Global Configuration of Joomla!. When you go there, you may notice a new permission called Web Services Login. This setting defines whether the user group can use the Web Services API.
When you extend the number of user groups who can use the Web Service API, there are some techniques you can use to limit the amount of data each user group can consume.
As each endpoint of the Web Service API is controlled by a plugin, we can limit the access to those endpoints simply by unpublishing these plugins. So, for instance, to avoid access to the contact endpoint with https://YourSite.com//api/index.php/v1/contact, we unpublish the Web Services –...