I am taking my first steps in integrating the Joomla API. I used this tutorial: https://blog.astrid-guenther.de/en/joomla-webservices/ Now I am wondering if it is really necessary to include the credentials when requesting data that is accessible through the website anyway.

The query works fine for me:

curl -X GET http://URL/index.php/v1/foos --header 'Accept: application/vnd.api+json' --header 'Authorization: Basic YWRtaW46YWRtaW4='

The query does not work:

curl -X GET http://URL/index.php/v1/foos

How do I achieve that I can query simple data without providing a user and password?

I do not want to create or modify any data.

2 Answers 2


Routes can be declared public by setting a flag. And it can be set after routes have been registered with the router. So this can be done using a custom web services plugin. It would use the onBeforeApiRoute event, the same used for declaring routes, so be aware the plugin must be ordered last to work properly.

public function onBeforeApiRoute($router)
    // Iterate over the routes.
    foreach ($router->getRoutes() as $route)
        // Check that we are altering only GET routes.
        if ($route->getMethods() === ['GET'])
            // Override the public flag.
            $defaults = $route->getDefaults();
            $defaults['public'] = true;

Also keep in mind that this is dangerous and can expose sensitive information, such as user data. Instead of making all routes public you should have a list of routes which you want to make public.

Just to clarify, the above method is for overriding routes added by core or 3rd party plugins and not your own. If you are developing your own web services plugin, you can set the public access when registering the route. When using Joomla\CMS\Router\ApiRouter::createCRUDRoutes() pass the 4th argument to enable public GETs:

    ['component' => 'com_foos'],

Or when instantiating the route manually:

$route = new Joomla\Router\Route(['GET'], 'v1/foos', 'foos.doFoos', [], ['public' => true]);

Please see https://github.com/joomla/joomla-cms/issues/32376 for mor Infos about authentication mechanism.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.