<p>You can do this using a custom module that adds an <code>authorId</code> condition to element queries, for <code>graphql/api</code> requests.</p>

<pre class="lang-php prettyprint-override"><code>use Craft;
use craft\elements\db\EntryQuery;
use yii\base\Event;
use yii\web\ForbiddenHttpException;

// ...

// Is this a GraphQL request?
if (Craft::$app-&gt;request-&gt;getActionSegments() == ['graphql', 'api']) {
    Event::on(EntryQuery::class, EntryQuery::EVENT_BEFORE_PREPARE, function(Event $event) {
        // Get the current user
        $user = Craft::$app-&gt;user-&gt;identity;

        // If no one is logged in, return a 403 error
        if (!$user) {
            throw new ForbiddenHttpException();
        }

        // Only Editors are allowed to see everything
        if (!$user-&gt;isInGroup('editors')) {
            /** @var EntryQuery $query */
            $query = $event-&gt;sender;
            $query-&gt;subQuery-&gt;andWhere(['authorId' =&gt; $user-&gt;id]);
        }
    });
}
</code></pre>

<p><strong>Note:</strong> Since the results will start changing for the same element query depending on who is logged in, you’ll also need to disable the <a href="https://docs.craftcms.com/v3/config/config-settings.html#enablegraphqlcaching" rel="noreferrer">enableGraphQlCaching</a> config setting.</p>

CC BY-SA 4.0
2021-08-23T17:48:09.623Z
Make sure you are using the correct config name for your Craft version:
`enableGraphQlCaching` before Craft CMS 3.7 and `enableGraphqlCaching` after Craft CMS 3.7
Ottó Radics
CC BY-SA 4.0
2020-04-28T21:35:47.127Z
2020-04-28T21:45:00.817Z
2020-04-28T21:45:00.817Z
Brandon Kelly
<p>How can we filter what entries are returned by a GraphQL query so that users cannot see entries authored by other people?</p>

<p>For example, <em>Editors</em> can access everything but <em>Writers</em> can only access their own entries.</p>

<graphql>
GraphQL: Prevent users seeing entries authored by other users
# GraphQL: Prevent users seeing entries authored by other users

(Asked by: username_0 on 2020-04-28)

How can we filter what entries are returned by a GraphQL query so that users cannot see entries authored by other people?

For example, *Editors* can access everything but *Writers* can only access their own entries.

**Tags:** graphql


---

## 1 answers

### Answer by username_1 on 2020-04-28. Score: 6 | Accepted answer

You can do this using a custom module that adds an authorId condition to element queries, for graphql/api requests.
use Craft;
use craft\elements\db\EntryQuery;
use yii\base\Event;
use yii\web\ForbiddenHttpException;

// ...

// Is this a GraphQL request?
if (Craft::$app->request->getActionSegments() == ['graphql', 'api']) {
    Event::on(EntryQuery::class, EntryQuery::EVENT_BEFORE_PREPARE, function(Event $event) {
        // Get the current user
        $user = Craft::$app->user->identity;

        // If no one is logged in, return a 403 error
        if (!$user) {
            throw new ForbiddenHttpException();
        }

        // Only Editors are allowed to see everything
        if (!$user->isInGroup('editors')) {
            /** @var EntryQuery $query */
            $query = $event->sender;
            $query->subQuery->andWhere(['authorId' => $user->id]);
        }
    });
}

Note: Since the results will start changing for the same element query depending on who is logged in, you’ll also need to disable the enableGraphQlCaching config setting.

> **Comments:**
> **username_2**: Make sure you are using the correct config name for your Craft version: `enableGraphQlCaching` before Craft CMS 3.7 and `enableGraphqlCaching` after Craft CMS 3.7  

---

