rest_role_restrict

REST Role Restrict provides a simple but powerful solution for controlling access to Drupal's REST API. It restricts all API access to only users with specific roles that site administrators can configure via a UI.

Installation

1. Download the module with Composer.
   
   
2. Enable the module.
   
   Use the Admin UI to enable the module.
   
   
3. Ensure dependencies are enabled.
   
   These core modules must be active for REST to function:
   • rest
   • serialization
   • user

Post-Installation

1. Go to the configuration page.
   
   Navigate to Configuration → Web Services → REST Role Restrict or go directly to:
   
   /admin/config/services/rest-role-restrict
   
   
2. Select allowed roles.
   
   Use the checkboxes to choose which user roles should be granted access to Drupal’s REST API.
   
   
3. Save the configuration.
   
   The settings will apply globally to all REST API requests.
   
   
4. Control access to the settings page.
   
   Only users with the administer rest role restrict permission can configure which roles have API access.
   
   
5. Disallowed users receive a structured error.
   
   When a user without an allowed role makes a REST API request, they will receive a JSON response like this:

   {
     "message": "Access to the REST API is restricted to specific roles. Contact your site administrator."
   }

Supporting this Module

If this module saves you time or adds value to your project, you can show your support in two ways:

• Buy me a coffee to say thanks:
  https://buymeacoffee.com/tylerhastain
• Want to contribute or sponsor development?
  Reach out directly if you're interested in helping improve or maintain the module — contributions, ideas, and support are always welcome!