what are the basis on which I should define resources tag in webapi.xml. for example if I build an api to return product information who can access it. I've searched for that but all I found is what is acl.xml file is used for


Valid values are self, anonymous, or a Magento resource, such as Magento_Customer::group.

  • anonymous => everyone can use the API
  • self => online logged-in customers can use the API
  • Magento resource, such as Magento_Customer::group => only admin users with the specified resource can access the API

An API should be as restrictive as possible to prevent unauthorized uses.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.