I'm trying to expose the getLatestUpdated() method of the Indexer class through the REST API. The endpoint is getting an auth token and all that - I can use protected endpoints no problem. What resources should I have requested or how can I give my extension permission to use the resource?

Here is what my webapi.xml looks like:

<?xml version="1.0"?>
<routes xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Webapi:etc/webapi.xsd">
    <route url="/V1/GetIndexerInfo/id/:id" method="GET">
        <service class="MyCompany\GetIndexerInfo\Api\GetIndexerInfoInterface" method="getInfo"/>
            <resource ref="Magento_Indexer::Indexer"/>
  • ref. Required. Referenced resource.
  • Valid values are self, anonymous, or a Magento resource, such as Magento_Customer::group.

     <route url="/V1/customers/:id" method="PUT">
            <service class="Magento\Customer\Api\CustomerRepositoryInterface" method="save"/>
                <resource ref="Magento_Customer::manage"/>

Now open acl.xml file where ref Magento resource, Magento_Customer::manage is defined

enter image description here

And this resources are visible under the Magento 2 admin System > Permissions > User Roles area. When we click on the Add New Role button or access to a role.

like this,

enter image description here


The answer was that, despite already having a good key, because this was new functionality, it seemed to require re-authorizing my key (getting a new token).


Try to give permission to your module and check.

  1. Create below file in your module.
    File: app/code/Neo/Yourmodulename/etc/acl.xml

    <?xml version="1.0"?>
    <config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:Acl/etc/acl.xsd">
                <resource id="Magento_Backend::admin">
                    <resource id="Neo_Yourmodulename::helloworld" title="Hello World" sortOrder="51">
  2. Flush Magento cache.

  3. For more details click here: Magento 2 Admin ACL Access Control Lists

  • ::helloworld - is this a class name or the name of the method invoked by the api? – Todd Oct 22 '18 at 19:26
  • This did not change anything unfortunately. I did go into integrations and add permission to my user. – Todd Oct 22 '18 at 20:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.