<p>Yes it is you can see here <a href="https://craftcms.stackexchange.com/questions/1087/check-user-is-in-user-group-custom-user-permissions">how to check permissions </a></p>

<p>You can get the <a href="https://docs.craftcms.com/api/v2/services/UserSessionService.html#getUser-detail" rel="nofollow noreferrer">current user</a> with </p>

<pre><code>$currentUser = craft()-&gt;userSession-getUser();
</code></pre>

<p>Then you can check the same conditions like in the example link. If the conditions are false you can return an empty array instead of your endpoints </p>

<pre><code>if(!$currentUser-&gt;isInGroup('groupHandle')) {
    return [];
} 
</code></pre>

<p>Please make sure to check if the current user is not null </p>

CC BY-SA 4.0
2018-06-16T10:02:23.293Z
Fantastic, thank you. Is there a way to throw an exception too, so that I can warn users who are not able to view the resource?
Adam Menczykowski
CC BY-SA 4.0
2018-06-16T10:06:23.057Z
You'll need to throw the exception in your transformer function, however keep in mind exceptions won't be thrown in live mode so the user will be redirected to the homepage instead. The quick and dirty way would be to `die()` your script out with a message. The clean way would be to create a custom route for each api endpoint and display the message in your controller
Robin Schambach
CC BY-SA 4.0
2018-06-16T10:33:38.613Z
`die('You cannot access this resource')` is exactly what I need for this. Thank you !!
Adam Menczykowski
CC BY-SA 4.0
2018-06-16T09:24:41.700Z
2018-06-16T09:24:41.700Z
Robin Schambach
<p>I'd like to Restrict access to Element API endpoint by the current user's group. </p>

<p>Is this possible Using Craft 2?</p>

<plugin-elementapi>
Restrict access to Element API endpoint
# Restrict access to Element API endpoint

(Asked by: username_0 on 2018-06-16)

I'd like to Restrict access to Element API endpoint by the current user's group.

Is this possible Using Craft 2?

**Tags:** plugin-elementapi

---

## 1 answers

### Answer by username_1 on 2018-06-16. Score: 2 | Accepted answer

Yes it is you can see here how to check permissions 
You can get the current user with 
$currentUser = craft()->userSession-getUser();

Then you can check the same conditions like in the example link. If the conditions are false you can return an empty array instead of your endpoints 
if(!$currentUser->isInGroup('groupHandle')) {
    return [];
} 

Please make sure to check if the current user is not null

> **Comments:**
> **username_0**: Fantastic, thank you. Is there a way to throw an exception too, so that I can warn users who are not able to view the resource?  
> **username_1**: You'll need to throw the exception in your transformer function, however keep in mind exceptions won't be thrown in live mode so the user will be redirected to the homepage instead. The quick and dirty way would be to `die()` your script out with a message. The clean way would be to create a custom route for each api endpoint and display the message in your controller  
> **username_0**: `die('You cannot access this resource')` is exactly what I need for this. Thank you !!  

---

