I'm trying to call REST endpoints from the browser. Initially, I'd like to be able to fetch product information.

It looks like session-based authorization is what I'm after.

I started by grabbing a Javascript swagger client from npm.

Now I'm trying to make a simple call to fetch products (I have but one in my local site currently).

m2.catalogProductRepositoryV1GetListGet().done((rsp) => {
  console.log('Products: ', rsp.body)

However, I'm getting a 401. Then I see this note in that same session-based-auth doc mentioned above

Customers can access resources that are configured with anonymous or self permission in the webapi.xml configuration file.

So I look in vendor/magento/module-catalog/etc/webapi.xml

<route url="/V1/products" method="GET">
    <service class="Magento\Catalog\Api\ProductRepositoryInterface" method="getList"/>
        <resource ref="Magento_Catalog::products" />

Notice no anonymous or self permission here. Now I'm thinking really? Products are not allowed to be consumed by the browser out of the box?

I'm understand Magento_Catalog::products refers to a Resource Model. I'm now trying to define and ACL, however, I'm unsure how to associate the ACL with public (not-logged in) users.

  • You can check version 2.3 with graphQL support that should allow to fetch product data without ACL (I am not sure what is the current scope of data available there). – Zefiryn Jan 17 '19 at 21:09
  • Thanks @Zefiryn, it looks like I could spend a week wrapping my head around this lol. – quickshiftin Jan 17 '19 at 21:36

You can create an API clone from that API:

<route url="/V1/all_products" method="GET">
<service class="{{your calss}}" method="getList"/>
    <resource ref="annoymous" />

After that, call your api and you can get them from anywhere without permission.

| improve this answer | |
  • Thanks for your answer! While this might work it is less than ideal for a couple of reasons: 1. LOTS of code duplication, 2. Client library needs to be hacked to change URLs for EVERY endpoint – quickshiftin Jan 17 '19 at 20:02
  • Giving an upvote as I got this approach to work, but I gather GraphQL is the "right way" to do this from 2.3 onwards. That said, I need to learn GraphQL before that's remotely viable, lol. – quickshiftin Jan 17 '19 at 22:05
  • also, I found a setting . Hope it can solve your issues unless clone api: configuration > service > magento web api >Allow Anonymous Guest Access > Yes – the light Jan 19 '19 at 14:36
  • Thanks, I will check this out on Tues and get back to you! – quickshiftin Jan 20 '19 at 20:50

It turns out you don't need to subclass as suggested in the previous answer, you can expose a built in interface directly in webapi.xml e.g.:

<route url="/V1/custom/products/attributes/:attributeCode" method="GET">
    <service class="Magento\Catalog\Api\ProductAttributeRepositoryInterface" method="get"/>
        <resource ref="anonymous" />
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.