Make REST API endpoint only available for authenticated users

Hi.

We have some REST API controllers right now and when the user isn’t authenticated, we’re using the permission_callback to check if the user is authenticated. Also, it’s nice to mention that we are using OAuth2.0 to authenticate our users. Are there any easy way of configuring an endpoint to only allow authenticated requests, instead of overriding the permission_callback? I’ve seen that the WP REST API does something similar in their controllers by returning a WP_Error with a status code of 401. I was wondering if there were any simpler way of protecting an endpoint. Right now, as I said, we’re using the permission_callback which has a function which returns false if the user isn’t authenticated / does not have permission to that endpoint. By returning true, the user has permission to access the endpoint, but when returning false, the default response is:

{
  "code": "rest_forbidden",
  "message": "Sorry, you are not allowed to do that.",
  "data": {
    "status": 403
  }
}

which sounds strange, as we want to test authentication and not authorization.

Any good solution for this, and can you point me in the right direction?

Thanks.

• This topic was modified 9 years, 5 months ago by Anders Stensaas.