Answers.Body: <p>When the Contact Get REST api is triggered, I can see that the permission clause for the ACL is being generated from the <code>whereClause()</code> funcion of <a href="https://github.com/civicrm/civicrm-core/blob/master/CRM/ACL/API.php#L122" rel="nofollow"><code>CRM_ACL_API</code></a>. Here a <code>contactId</code>(previously <a href="https://github.com/civicrm/civicrm-core/blob/master/CRM/Contact/BAO/Query.php#L4680" rel="nofollow">passed as NULL</a>) is fetched from the session (logged in user id) and the contact from <code>api_key</code> is <strong>actually</strong> not taken into account. Hence a 0 is set for <code>ContactId</code> and ACL permissions are not respected.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-08-11T11:12:49.290Z
Answers.Text: Exactly what I needed to know - thanks! Now to see if I can fix it...
  (will assign bounty as soon as I can - StackExchange says I need to wait six hours)
Answers.UserDisplayName: Andrew West
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-08-11T09:40:02.153Z
Answers.LastActivityDate: 2015-08-11T09:40:02.153Z
Answers.UserDisplayName: jitendra - fuzion
Answers.Body: <p>I tested this locally &amp; it worked fine - but looking at the wordpress code the signature of the loadBootStrap function does not match the signature of drupal (which works). </p>
  
  <p>I expect it's not responding correctly to</p>
  
  <pre><code>  CRM_Utils_System::loadBootStrap(array('uid' =&gt; $uid), TRUE, FALSE);
  </code></pre>
  
  <p>Since     </p>
  
  <p>return $config->userSystem->loadBootStrap($params, $loadUser, $throwError, $realPath);</p>
  
  <p>passes in an array but WP seems to be unable to cope with that</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-06-21T10:12:42.730Z
Answers.LastActivityDate: 2016-06-21T10:12:42.730Z
Answers.UserDisplayName: eileen
Body: <p>My REST API call returns data fine as long as the user has 'view all contacts' permission. But if I turn that off and instead grant the user access to a particular group via an ACL, I get nothing. I've confirmed that the user can see the relevant data through the UI.</p>
  
  <p><em>Should</em> that work? Or are ACLs not taken into account by the REST API?</p>
  
  <p>Using WordPress and Civi 4.5.8.</p>
  
  <p>Update 1: <a href="https://forum.civicrm.org/index.php?topic=35107.0" rel="nofollow">this issue</a> on the forum suggests it might not be WordPress specific.</p>
  
  <p>Update 2: Just to clarify exactly what I'm doing, here's the relevant part of the URL:</p>
  
  <p>/wp-content/plugins/civicrm/civicrm/extern/rest.php?entity=Contact&amp;action=get&amp;api_key=xxx&amp;key=xxx</p>
  
  <p>I can get the data I want by using the API key of an admin, or if a non-admin has 'View all contacts' permission. But I get no results if the non-admin lacks this permission and only has access via an ACL. (If I change the API key I get an authentication error, so I'm confident that's correct.)</p>
  
Tags: <api><rest>
Title: REST API and ACLs - should the API return contacts made accessible via an ACL?
ThreadText: # REST API and ACLs - should the API return contacts made accessible via an ACL?
  
  (Asked by: username_0 on 2015-08-06)
  
  My REST API call returns data fine as long as the user has 'view all contacts' permission. But if I turn that off and instead grant the user access to a particular group via an ACL, I get nothing. I've confirmed that the user can see the relevant data through the UI.
  
  *Should* that work? Or are ACLs not taken into account by the REST API?
  
  Using WordPress and Civi 4.5.8.
  
  Update 1: [this issue](https://forum.civicrm.org/index.php?topic=35107.0) on the forum suggests it might not be WordPress specific.
  
  Update 2: Just to clarify exactly what I'm doing, here's the relevant part of the URL:
  
  /wp-content/plugins/civicrm/civicrm/extern/rest.php?entity=Contact&action=get&api\_key=xxx&key=xxx
  
  I can get the data I want by using the API key of an admin, or if a non-admin has 'View all contacts' permission. But I get no results if the non-admin lacks this permission and only has access via an ACL. (If I change the API key I get an authentication error, so I'm confident that's correct.)
  
  **Tags:** api, rest
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2015-08-11. Score: 2 | Accepted answer
  
  When the Contact Get REST api is triggered, I can see that the permission clause for the ACL is being generated from the `whereClause()` funcion of [`CRM_ACL_API`](https://github.com/civicrm/civicrm-core/blob/master/CRM/ACL/API.php#L122). Here a `contactId`(previously [passed as NULL](https://github.com/civicrm/civicrm-core/blob/master/CRM/Contact/BAO/Query.php#L4680)) is fetched from the session (logged in user id) and the contact from `api_key` is **actually** not taken into account. Hence a 0 is set for `ContactId` and ACL permissions are not respected.
  
  > **Comments:**
  > **username_0**: Exactly what I needed to know - thanks! Now to see if I can fix it... (will assign bounty as soon as I can - StackExchange says I need to wait six hours)  
  
  ---
  
  ### Answer by username_2 on 2016-06-21. Score: 0
  
  I tested this locally & it worked fine - but looking at the wordpress code the signature of the loadBootStrap function does not match the signature of drupal (which works).
  
  I expect it's not responding correctly to
  
  ```
    CRM_Utils_System::loadBootStrap(array('uid' => $uid), TRUE, FALSE);
  
  ```
  
  Since
  
  return $config->userSystem->loadBootStrap($params, $loadUser, $throwError, $realPath);
  
  passes in an array but WP seems to be unable to cope with that
  
  
  ---
  
  