I have a route defined in one of my modules like this

<route url="/V1/some/path/:type" method="GET">
    <service class="SomeClassOrInterfaceHere" method="getType"/>
        <resource ref="????" />

What this basically says is that for the endpoint /V1/some/path/:type (which contains a parameter type) the method getType from the class (or preference for the interface) SomeClassOrInterfaceHere is called. This works nicely, but I may need to allow or not allow access on this url to an admin depending on the value of the type parameter.
type can in theory be anything so creating one endpoint and one acl resource for each type is not an option. Is there something I can put in the resource section (or any other ideas) to be able to control at application level the access to this endpoint?

1 Answer 1


I didn't find a way to use whildcards or additional access validation classes so I went with this approach.

I placed in the resource tag <resource ref="???" /> a general resource name that is the root of all my other ACL resources for the module. Basically if you have access to any of the module's ACL, you have access to this general resource.

And I added a plugin for my SomeClassOrInterfaceHere only in webapi_rest/di.xml where I check the validity of the $type parameter.
If it's valid, I proceed with the regular response. Otherwise I throw n Magento\Framework\Exception\AuthorizationException` exception

public function beforeGetTypes(SomeClassOrInterfaceHere $subject, string $type)
    $isAllowed = 'Custom logic here that returns true or false'($type);
    return $isAllowed ? null : throw new AuthorizationException(
        __("The consumer isn't authorized to access %resources.", "This {$type}")

this is not pretty because the endpoint is still reached but nothing gets executed if I'm not supposed to have access.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.