Answers.Body: <p>I believe there is currently a bug. I have submitted a bug report:</p>
  
  <p><a href="https://issues.civicrm.org/jira/browse/CRM-20582" rel="nofollow noreferrer">https://issues.civicrm.org/jira/browse/CRM-20582</a></p>
  
  <p>When I ran into my issue, I was told:</p>
  
  <p>"If you need a quick fix that doesn't involve granting more permissions than users ought to have, take a look at <a href="https://docs.civicrm.org/dev/en/master/hooks/hook_civicrm_alterAPIPermissions/" rel="nofollow noreferrer">https://docs.civicrm.org/dev/en/master/hooks/hook_civicrm_alterAPIPermissions/</a>."</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-05-16T16:00:45.677Z
Answers.LastActivityDate: 2017-05-16T16:00:45.677Z
Answers.UserDisplayName: Randy Tobias
Body: <p>We are using REST urls to pull data direct from Civi reports into Excel for analysis purposes. Within Civi the users are restricted via granular ACLs to specific groups of contacts. </p>
  
  <p>WP role permission  "Edit all contacts" is off for users.</p>
  
  <p>WP role permission  "CiviCRM:access AJAX API" -  is on for users and the user has their own API key generated.</p>
  
  <p>However when we extract the data via the rest url, it gives the error
  "API permission check failed for ReportTemplate/getrows call; insufficient permission: requires administer CiviCRM"</p>
  
  <p><a href="https://i.sstatic.net/tUfug.jpg" rel="nofollow noreferrer"><img src="https://i.sstatic.net/tUfug.jpg" alt="enter image description here"></a></p>
  
  <p>REST url looks as follows:</p>
  
  <p>XXXXX/wp-content/plugins/civicrm/civicrm/extern/rest.php?entity=ReportTemplate&amp;action=getrows&amp;instance_id=94&amp;options[limit]=500&amp;api_key=PXXXXXXXXXXX3X&amp;key=074cXXXXXXXXXXX259&amp;json=1</p>
  
  <p>We can get around the "requires administer CiviCRM" by adding a block to civicrm/CRM/Core/DAO/permissions.php as follows:</p>
  
  <pre><code>$permissions['report_template'] = array(
      'getrows' =&gt; array(
        'access CiviCRM',
        'access AJAX API',
      ),
    );
  </code></pre>
  
  <p>But that doesn’t respect the ACL group permissions – is there any way to limit it to just the data the user should normally be able to see?  We are stuck with all records or no records.</p>
  
Tags: <api><permissions><ajax><rest>
Title: AJAX API permissions
ThreadText: # AJAX API permissions
  
  (Asked by: username_0 on 2017-05-16)
  
  We are using REST urls to pull data direct from Civi reports into Excel for analysis purposes. Within Civi the users are restricted via granular ACLs to specific groups of contacts.
  
  WP role permission "Edit all contacts" is off for users.
  
  WP role permission "CiviCRM:access AJAX API" - is on for users and the user has their own API key generated.
  
  However when we extract the data via the rest url, it gives the error
  "API permission check failed for ReportTemplate/getrows call; insufficient permission: requires administer CiviCRM"
  
  [![enter image description here](https://i.sstatic.net/tUfug.jpg)](https://i.sstatic.net/tUfug.jpg)
  
  REST url looks as follows:
  
  XXXXX/wp-content/plugins/civicrm/civicrm/extern/rest.php?entity=ReportTemplate&action=getrows&instance\_id=94&options[limit]=500&api\_key=PXXXXXXXXXXX3X&key=074cXXXXXXXXXXX259&json=1
  
  We can get around the "requires administer CiviCRM" by adding a block to civicrm/CRM/Core/DAO/permissions.php as follows:
  
  ```
  $permissions['report_template'] = array(
      'getrows' => array(
        'access CiviCRM',
        'access AJAX API',
      ),
    );
  
  ```
  
  But that doesn’t respect the ACL group permissions – is there any way to limit it to just the data the user should normally be able to see? We are stuck with all records or no records.
  
  **Tags:** api, permissions, ajax, rest
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2017-05-16. Score: 2
  
  I believe there is currently a bug. I have submitted a bug report:
  
  <https://issues.civicrm.org/jira/browse/CRM-20582>
  
  When I ran into my issue, I was told:
  
  "If you need a quick fix that doesn't involve granting more permissions than users ought to have, take a look at <https://docs.civicrm.org/dev/en/master/hooks/hook_civicrm_alterAPIPermissions/>."
  
  
  ---
  
  