Answers.Body: <p>You probabky have to give anonymous users the permission "CiviCRM: access AJAX API".</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-10-20T13:25:07.820Z
Answers.Text: That would work, but is there anyway to not give them complete access to the API?  Would that let anyone run any CiviCRM API call?
Answers.UserDisplayName: ermSO
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-10-23T05:02:37.620Z
Answers.Text: The permission only allows accessing the API - what they can do with it still depends on the other permissions they do (not) have. For example if anonymous users are not allowed to see or edit contacts, they won't be allowed to do that via the API either.
Answers.UserDisplayName: Fabian
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-09-25T07:49:11.733Z
Answers.LastActivityDate: 2017-09-25T07:49:11.733Z
Answers.UserDisplayName: Fabian
Body: <p>I am writing an extension which uses a CRM.api3 call in javascript on the contribution page.  However, the link that is generated is lacking the "administrator" part.  For example,</p>
  
  <p>The API call to StateProvince generates this:
  <a href="http://localhost:81/example.org/index.php?option=com_civicrm&amp;task=civicrm/ajax/rest&amp;entity=StateProvince&amp;action=get&amp;json=%7B%22sequential%22%3A1%2C%22id%22%3A%221042%22%7D" rel="nofollow noreferrer">http://localhost:81/example.org/index.php?option=com_civicrm&amp;task=civicrm/ajax/rest&amp;entity=StateProvince&amp;action=get&amp;json=%7B%22sequential%22%3A1%2C%22id%22%3A%221042%22%7D</a></p>
  
  <p>That gives a Internal Server Error 500 message.</p>
  
  <p>However if I add "administrator" to the link:
  <a href="http://localhost:81/example.org/administrator/index.php?option=com_civicrm&amp;task=civicrm/ajax/rest&amp;entity=StateProvince&amp;action=get&amp;json=%7B%22sequential%22%3A1%2C%22id%22%3A%221042%22%7D" rel="nofollow noreferrer">http://localhost:81/example.org/administrator/index.php?option=com_civicrm&amp;task=civicrm/ajax/rest&amp;entity=StateProvince&amp;action=get&amp;json=%7B%22sequential%22%3A1%2C%22id%22%3A%221042%22%7D</a></p>
  
  <p>it asks the user to log-in and then works fine.  How can I allow my extension's javascript to call the StateProvince api Get method without making the user log in?</p>
  
  <p>Below is my code:</p>
  
  <pre><code>var myStateInfo = '';
  CRM.api3('StateProvince', 'get', { "sequential": 1, "id": myStateId }).done(function(result) { 
      myStateInfo = result;
  });
  </code></pre>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-09-24T09:49:06.347Z
Comments.Text: Try using ‘check_permissions = false’ as a parameter in the API.
Comments.UserDisplayName: jitendra - fuzion
Tags: <api><extension><permissions><javascript>
Title: API URL needs administrator
ThreadText: # API URL needs administrator
  
  (Asked by: username_0 on 2017-09-24)
  
  I am writing an extension which uses a CRM.api3 call in javascript on the contribution page.  However, the link that is generated is lacking the "administrator" part.  For example,
  The API call to StateProvince generates this:
  http://localhost:81/example.org/index.php?option=com_civicrm&task=civicrm/ajax/rest&entity=StateProvince&action=get&json=%7B%22sequential%22%3A1%2C%22id%22%3A%221042%22%7D
  That gives a Internal Server Error 500 message.
  However if I add "administrator" to the link:
  http://localhost:81/example.org/administrator/index.php?option=com_civicrm&task=civicrm/ajax/rest&entity=StateProvince&action=get&json=%7B%22sequential%22%3A1%2C%22id%22%3A%221042%22%7D
  it asks the user to log-in and then works fine.  How can I allow my extension's javascript to call the StateProvince api Get method without making the user log in?
  Below is my code:
  var myStateInfo = '';
  CRM.api3('StateProvince', 'get', { "sequential": 1, "id": myStateId }).done(function(result) { 
      myStateInfo = result;
  });
  
  **Tags:** api, extension, permissions, javascript
  
  > **Comments:**
  > **username_1**: Try using ‘check_permissions = false’ as a parameter in the API.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2017-09-25. Score: 1
  
  You probabky have to give anonymous users the permission "CiviCRM: access AJAX API".
  
  > **Comments:**
  > **username_0**: That would work, but is there anyway to not give them complete access to the API?  Would that let anyone run any CiviCRM API call?  
  > **username_2**: The permission only allows accessing the API - what they can do with it still depends on the other permissions they do (not) have. For example if anonymous users are not allowed to see or edit contacts, they won't be allowed to do that via the API either.  
  
  ---
  
  