Answers.Body: <p>It sounds like mod_rewrite is overzealously configured.  You can edit your Apache(?) redirect, either in your .htaccess and/or your .conf files.  You can add a command like:</p>
  
  <pre><code>RewriteCond %{REQUEST_FILENAME} !-f
  </code></pre>
  
  <p>And that says not to do rewrites below it if the exact path you're requesting resolves to a file that exists.  That way, your request is never redirected to Joomla. <a href="http://httpd.apache.org/docs/current/mod/mod_rewrite.html" rel="nofollow">See here</a> for further documentation.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-03-30T11:55:13.807Z
Answers.Text: I think if that were the case I would not be getting a 200 response. The Apache response is just fine, headers are great etc, it is just the data that are empty.  Edited the question to show the relevant code.
Answers.UserDisplayName: Elin
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-03-30T06:53:09.890Z
Answers.LastActivityDate: 2015-03-30T06:53:09.890Z
Answers.UserDisplayName: Jon G - Megaphone Tech
Answers.Body: <p>This is going to be a fuller answer eventually but for right now it is a partial answer that addresses how to get publicly available data via REST.</p>
  
  <p>The REST API works differently than the PHP or other versions of the API. Some of this is documented and some is not. </p>
  
  <p>The most important difference between the rest API and the others is that the REST API does not instantiate an authenticated user as the current user in a Joomla! environment. Therefore it cannot use any of the Joomla access controls when determining what data to provide or what actions to allow. Also  because the current user is not an authenticated user, CiviCRM roles (such as the default <code>Authenticated User</code> and <code>Administrator</code>) are not available.  Therefore the only role that is available is <code>Everyone</code>.</p>
  
  <p>However this does not literally mean that everyone (in the sense of the unregistered public) can see.  This is because there must be a contact record with an api_key value and a registered Joomla user associated with that contact. </p>
  
  <p>This also does not mean that Everyone can see everything. An ACL record still must be created. That is you must create ACL for each kind of data that you want to have accessible to the REST interface. </p>
  
  <p>For <code>GET</code> the basic approach should be to create a group that contains the records you want to return. Call this, for example, MyGroup. To reiterate: <em>This is not the group of users who have access to the interface, it is the group of users about whom data will be returned.</em></p>
  
  <p>In the ACL interface click on Manage ACL.  </p>
  
  <ul>
  <li>For Role: Everyone </li>
  <li>Action:View</li>
  <li>Type of Data: A group of contacts</li>
  <li>Group: MyGroup</li>
  </ul>
  
  <p>These settings will allow you to use the REST interface to return data on one or more users in the MyGroup group, with data based on the URL you craft.</p>
  
  <p>If you have a Joomla front end and you want to access a list of contacts via the rest interface you need to include a number of steps. This includes reading the keys, crafting the URL, and creating the request.</p>
  
  <ol>
  <li><p>If you have a civicrm.settings.php file you can obtain the site key with the following code:</p>
  
  <pre><code>require_once JPATH_ROOT . '/administrator/components/com_civicrm/helpers/api.php'; 
  CivicrmHelperApi::civiInit();
  echo CIVICRM_SITE_KEY;
  </code></pre></li>
  </ol>
  
  <p>However, if you don't have access to the helper you can just <code>require_once</code> the settings file and that will define the site key constant.</p>
  
  <ol start="2">
  <li><p>You also need to to access the individual user level API key. Most likely it would make the most sense to  to store that in a file locally and read it in. Call that <code>CIVICRM_API_KEY</code>.</p></li>
  <li><p>Then you can craft a request url, which will have three parts, the base, the api parameters, and the keys.</p>
  
  <pre><code>// Of course this should be https if possible.
  $restbase  = 'http://example.com/jooomla-cms/administrator/components/com_civicrm/civicrm/extern/rest.php?';
  $restkeys = '&amp;key='. CIVICRM_SITE_KEY .  '&amp;api_key=' . CIVICRM_API_KEY;
  $restvars = 'entity=contact&amp;action=get&amp;json={"sequential":1,"return":"first_name"}';
  
  // Make the request
  $http = new JHttp();
  $return = $http-&gt;get($restbase2 . $restvars  . $restkeys);
  
  // Do something with the data
  $body = $return-&gt;body;
  $values = json_decode($body)-&gt;values;
  
  foreach ($values as $value)
  {
      echo '&lt;div&gt;' . htmlspecialchars($value-&gt;first_name) . ' &lt;/div&gt;';
  }
  </code></pre></li>
  </ol>
  
  <p>Some notes</p>
  
  <p>There are many combinations of actions and entities which cannot be created in the ACL settings. </p>
  
  <p>Depending on what you are envisioning you may want to create a Joomla user to be the one that provides access or you could register a user for each application that will be allowed to access publicly available data via the REST API.  </p>
  
  <p>These include most post and delete actions. In these cases there is sometimes checking of specific Joomla permissions such as access Civicrm but it does not work as expected. At least at this point the authorization process always returns false unless you have given the public permission to do these things via Joomla ACL. Not a good idea. </p>
  
  <p><strong>Update</strong></p>
  
  <p>I sent a <a href="https://github.com/civicrm/civicrm-core/pull/5680" rel="nofollow">pull request</a> for a fix for this so that now permissions will be checked. You can apply this as a patch and it will work the way the documentation says (or at least it has been for me -- would love a few people to test it).</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-04-14T11:47:04.717Z
Answers.Text: I think I found the bug that is causing the problem with authentication.
Answers.UserDisplayName: Elin
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-04-18T13:35:04.367Z
Answers.Text: This report contains a link to a gist with code to force permissions checks to be done using the userid rather than an empty user. The empty user is why it worked when you made the data public.
Answers.UserDisplayName: Elin
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-04-05T20:17:09.070Z
Answers.Text: Great, glad to know it's getting solved. I have been tripped up on more than one occasion with permissions, especially with joomla.  I hope you can write a good summary of what you found so that we can all find it next time we run into the same or similar problem.
Answers.UserDisplayName: DaveD
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-04-05T16:03:07.393Z
Answers.LastActivityDate: 2015-04-25T20:57:57.623Z
Answers.LastEditDate: 2015-04-25T20:57:57.623Z
Answers.UserDisplayName: Elin
Body: <p>I've mainly used the php apis in the past but I would like to use the REST API. I added an api key to the contact record, and I attempted to use the really simple example in the documentation.  Yet I just keep getting</p>
  
  <p><code>{"is_error":0,"version":3,"count":0,"values":[]}"</code></p>
  
  <p>I'm using really simple examples like</p>
  
  <p><code>entity=Contact&amp;action=get</code>
  (of course with the base url and rest.php? and then the keys at the end). I'm pretty sure the url is right since it says there is no error (and if I change things I definitely get an error response). If I use the php api I get data, so it's not that there is no data.</p>
  
  <p>Update 2</p>
  
  <p>Actually I think I was wrong about at least where the problem is because clearly the checking for a valid CMS user record is happening.  If I use a url like this:</p>
  
  <p><a href="http://example.com/administrator/components/com_civicrm/civicrm/extern/rest.php?entity=Contact&amp;action=get&amp;group_id=6&amp;options[limit]=25&amp;options[offset]=50&amp;json=1&amp;key=4d0b3527f437210aa4479ca8fa4936eb&amp;api_key=654321" rel="nofollow">http://example.com/administrator/components/com_civicrm/civicrm/extern/rest.php?entity=Contact&amp;action=get&amp;group_id=6&amp;options[limit]=25&amp;options[offset]=50&amp;json=1&amp;key=4d0b3527f437210aa4479ca8fa4936eb&amp;api_key=654321</a>'</p>
  
  <p>I get (along with a good apache response)
  <code>{"is_error":0,"version":3,"count":0,"values":[]}</code></p>
  
  <p>However if I add a <code>var_dump($apiResponse);</code> right before the return in run()  in Civi\API\kernel.php I definitely get the data  and count is not 0. And that array comes through just fine to \api\api.php. So whatever is going wrong is happening somewhere after that.</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-03-31T14:06:05.753Z
Comments.Text: Can you try constructing it with a "frontend" url instead of a "backend" url?
Comments.UserDisplayName: Coleman
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-04-01T00:19:39.910Z
Comments.Text: I actually thought about that as a possibility, but it didn't work in an obvious way. I think that something is going wrong with  bootAndRun().  However the documentation is a bit tricky too; it really says to give the full path to the rest.php class which is in /administrator.
Comments.UserDisplayName: Elin
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-04-03T17:51:20.720Z
Comments.Text: Just wondering.... what if you specify the values to be returned in your REST call?
Comments.UserDisplayName: DaveD
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-04-03T18:11:45.973Z
Comments.Text: I'm not sure what you mean.  The api specifically requests a set of values based on the query. In this case all the contact data on contacts who are in group 6.
Comments.UserDisplayName: Elin
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-04-03T18:20:36.270Z
Comments.Text: Instead of asking for 'all the contact data', specify just a few fields to be returned.  Using the super-nice api explorer in the new v4.6 (now officially out!!) I specified to return just last name and birthdate: `/sites/all/modules/civicrm/extern/rest.php?entity=Contact&action=get&json={"sequential":1,"return":"last_name,birth_date"}&api_key=yourkey&key=sitekey
  `
Comments.UserDisplayName: DaveD
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-04-04T00:22:30.950Z
Comments.Text: Okay I did try this but it didn't work unfortunately (meaning I tried generating the link in the api explorer --- ridiculous for not doing that earlier).
Comments.UserDisplayName: Elin
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-04-04T01:57:16.390Z
Comments.Text: `administrator/components/com_civicrm/civicrm/extern/rest.php?entity=Contact&action=get&json={"debug":1,"sequential":1}&api_key=yoursitekey&key=yourkey`  that is the url generated in the api generator, notice that the yoursiteky and yourkey are reversed from what you have ...  bug in the explorer I think.
Comments.UserDisplayName: Elin
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-04-05T02:20:48.800Z
Comments.Text: The only other thing I can think of is perhaps the user associated with the api_key does not have sufficient civicrm permissions to return the data.
Comments.UserDisplayName: DaveD
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-04-05T11:14:00.987Z
Comments.Text: Absolutely the user has permission, it is my record i.e. the super admin.  Interestingly, in the api explorer the data is returned unless you let the session expire, in which case it returns the login page. I did get this one thing when using debug in the request `"undefined_fields":["contact_is_deleted"]`.
Comments.UserDisplayName: Elin
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-04-05T14:40:01.237Z
Comments.Text: Well I think you are right because I started playing around with permissions and i did eventually get some permissions errors and also, finally, some data.  Now I have to figure out which was the change that mattered.
Comments.UserDisplayName: Elin
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-04-05T20:20:03.200Z
Comments.Text: Yeah, the API explorer needs to run under a session so when the session expires, it requires you to log in again.  I suspect it's more to allow the page to be ajax-y to fill select lists, etc.
Comments.UserDisplayName: DaveD
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-04-06T03:10:07.653Z
Comments.Text: Well, no, actually if you click that button to show the results even when the session is expired (assuming you already had made your selections) it will render the login screen in the display area. It doesn't at that point force a new login or anything.
Comments.UserDisplayName: Elin
Tags: <api><joomla>
Title: Why am I getting no values when using REST api?
ThreadText: # Why am I getting no values when using REST api?
  
  (Asked by: username_0 on 2015-03-29)
  
  I've mainly used the php apis in the past but I would like to use the REST API. I added an api key to the contact record, and I attempted to use the really simple example in the documentation. Yet I just keep getting
  
  `{"is_error":0,"version":3,"count":0,"values":[]}"`
  
  I'm using really simple examples like
  
  `entity=Contact&action=get`
  (of course with the base url and rest.php? and then the keys at the end). I'm pretty sure the url is right since it says there is no error (and if I change things I definitely get an error response). If I use the php api I get data, so it's not that there is no data.
  
  Update 2
  
  Actually I think I was wrong about at least where the problem is because clearly the checking for a valid CMS user record is happening. If I use a url like this:
  
  <http://example.com/administrator/components/com_civicrm/civicrm/extern/rest.php?entity=Contact&action=get&group_id=6&options[limit]=25&options[offset]=50&json=1&key=4d0b3527f437210aa4479ca8fa4936eb&api_key=654321>'
  
  I get (along with a good apache response)
  `{"is_error":0,"version":3,"count":0,"values":[]}`
  
  However if I add a `var_dump($apiResponse);` right before the return in run() in Civi\API\kernel.php I definitely get the data and count is not 0. And that array comes through just fine to \api\api.php. So whatever is going wrong is happening somewhere after that.
  
  **Tags:** api, joomla
  
  > **Comments:**
  > **username_1**: Can you try constructing it with a "frontend" url instead of a "backend" url?  
  > **username_0**: I actually thought about that as a possibility, but it didn't work in an obvious way. I think that something is going wrong with  bootAndRun().  However the documentation is a bit tricky too; it really says to give the full path to the rest.php class which is in /administrator.  
  > **username_2**: Just wondering.... what if you specify the values to be returned in your REST call?  
  > **username_0**: I'm not sure what you mean.  The api specifically requests a set of values based on the query. In this case all the contact data on contacts who are in group 6.  
  > **username_2**: Instead of asking for 'all the contact data', specify just a few fields to be returned.  Using the super-nice api explorer in the new v4.6 (now officially out!!) I specified to return just last name and birthdate: `/sites/all/modules/civicrm/extern/rest.php?entity=Contact&action=get&json={"sequential":1,"return":"last_name,birth_date"}&api_key=yourkey&key=sitekey `  
  > **username_0**: Okay I did try this but it didn't work unfortunately (meaning I tried generating the link in the api explorer --- ridiculous for not doing that earlier).  
  > **username_0**: `administrator/components/com_civicrm/civicrm/extern/rest.php?entity=Contact&action=get&json={"debug":1,"sequential":1}&api_key=yoursitekey&key=yourkey`  that is the url generated in the api generator, notice that the yoursiteky and yourkey are reversed from what you have ...  bug in the explorer I think.  
  > **username_2**: The only other thing I can think of is perhaps the user associated with the api_key does not have sufficient civicrm permissions to return the data.  
  > **username_0**: Absolutely the user has permission, it is my record i.e. the super admin.  Interestingly, in the api explorer the data is returned unless you let the session expire, in which case it returns the login page. I did get this one thing when using debug in the request `"undefined_fields":["contact_is_deleted"]`.  
  > **username_0**: Well I think you are right because I started playing around with permissions and i did eventually get some permissions errors and also, finally, some data.  Now I have to figure out which was the change that mattered.  
  > **username_2**: Yeah, the API explorer needs to run under a session so when the session expires, it requires you to log in again.  I suspect it's more to allow the page to be ajax-y to fill select lists, etc.  
  > **username_0**: Well, no, actually if you click that button to show the results even when the session is expired (assuming you already had made your selections) it will render the login screen in the display area. It doesn't at that point force a new login or anything.  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_0 on 2015-04-05. Score: 5 | Accepted answer
  
  This is going to be a fuller answer eventually but for right now it is a partial answer that addresses how to get publicly available data via REST.
  
  The REST API works differently than the PHP or other versions of the API. Some of this is documented and some is not.
  
  The most important difference between the rest API and the others is that the REST API does not instantiate an authenticated user as the current user in a Joomla! environment. Therefore it cannot use any of the Joomla access controls when determining what data to provide or what actions to allow. Also because the current user is not an authenticated user, CiviCRM roles (such as the default `Authenticated User` and `Administrator`) are not available. Therefore the only role that is available is `Everyone`.
  
  However this does not literally mean that everyone (in the sense of the unregistered public) can see. This is because there must be a contact record with an api\_key value and a registered Joomla user associated with that contact.
  
  This also does not mean that Everyone can see everything. An ACL record still must be created. That is you must create ACL for each kind of data that you want to have accessible to the REST interface.
  
  For `GET` the basic approach should be to create a group that contains the records you want to return. Call this, for example, MyGroup. To reiterate: *This is not the group of users who have access to the interface, it is the group of users about whom data will be returned.*
  
  In the ACL interface click on Manage ACL.
  
  * For Role: Everyone
  * Action:View
  * Type of Data: A group of contacts
  * Group: MyGroup
  
  These settings will allow you to use the REST interface to return data on one or more users in the MyGroup group, with data based on the URL you craft.
  
  If you have a Joomla front end and you want to access a list of contacts via the rest interface you need to include a number of steps. This includes reading the keys, crafting the URL, and creating the request.
  
  1. If you have a civicrm.settings.php file you can obtain the site key with the following code:
  
     ```
     require_once JPATH_ROOT . '/administrator/components/com_civicrm/helpers/api.php'; 
     CivicrmHelperApi::civiInit();
     echo CIVICRM_SITE_KEY;
  
     ```
  
  However, if you don't have access to the helper you can just `require_once` the settings file and that will define the site key constant.
  
  2. You also need to to access the individual user level API key. Most likely it would make the most sense to to store that in a file locally and read it in. Call that `CIVICRM_API_KEY`.
  3. Then you can craft a request url, which will have three parts, the base, the api parameters, and the keys.
  
     ```
     // Of course this should be https if possible.
     $restbase  = 'http://example.com/jooomla-cms/administrator/components/com_civicrm/civicrm/extern/rest.php?';
     $restkeys = '&key='. CIVICRM_SITE_KEY .  '&api_key=' . CIVICRM_API_KEY;
     $restvars = 'entity=contact&action=get&json={"sequential":1,"return":"first_name"}';
  
     // Make the request
     $http = new JHttp();
     $return = $http->get($restbase2 . $restvars  . $restkeys);
  
     // Do something with the data
     $body = $return->body;
     $values = json_decode($body)->values;
  
     foreach ($values as $value)
     {
         echo '<div>' . htmlspecialchars($value->first_name) . ' </div>';
     }
  
     ```
  
  Some notes
  
  There are many combinations of actions and entities which cannot be created in the ACL settings.
  
  Depending on what you are envisioning you may want to create a Joomla user to be the one that provides access or you could register a user for each application that will be allowed to access publicly available data via the REST API.
  
  These include most post and delete actions. In these cases there is sometimes checking of specific Joomla permissions such as access Civicrm but it does not work as expected. At least at this point the authorization process always returns false unless you have given the public permission to do these things via Joomla ACL. Not a good idea.
  
  **Update**
  
  I sent a [pull request](https://github.com/civicrm/civicrm-core/pull/5680) for a fix for this so that now permissions will be checked. You can apply this as a patch and it will work the way the documentation says (or at least it has been for me -- would love a few people to test it).
  
  > **Comments:**
  > **username_2**: Great, glad to know it's getting solved. I have been tripped up on more than one occasion with permissions, especially with joomla.  I hope you can write a good summary of what you found so that we can all find it next time we run into the same or similar problem.  
  > **username_0**: I think I found the bug that is causing the problem with authentication.  
  > **username_0**: This report contains a link to a gist with code to force permissions checks to be done using the userid rather than an empty user. The empty user is why it worked when you made the data public.  
  
  ---
  
  ### Answer by username_3 on 2015-03-30. Score: 0
  
  It sounds like mod\_rewrite is overzealously configured. You can edit your Apache(?) redirect, either in your .htaccess and/or your .conf files. You can add a command like:
  
  ```
  RewriteCond %{REQUEST_FILENAME} !-f
  
  ```
  
  And that says not to do rewrites below it if the exact path you're requesting resolves to a file that exists. That way, your request is never redirected to Joomla. [See here](http://httpd.apache.org/docs/current/mod/mod_rewrite.html) for further documentation.
  
  > **Comments:**
  > **username_0**: I think if that were the case I would not be getting a 200 response. The Apache response is just fine, headers are great etc, it is just the data that are empty.  Edited the question to show the relevant code.  
  
  ---
  
  