Browsable API

[Thomas Ruffie]

Hello everyone.
I searched for this but couldnt find an answer:

I'd like to hide the browsable API EXCEPT for the superuser. I don't want my users to be able to reach the api page and POST from there. So I'd like it to be hidden from everyone but the superuser(s).
I don't know if that's possible.
Thanks!

[Tom Christie]

> I'd like to hide the browsable API EXCEPT for the superuser.

To simply disable the browsable API in all cases you'd remove BrowsableAPIRenderer from the renderer_classes attribute on the view, or the DEFAULT_RENDERER_CLASSES settings key.

That won't work in your case as you'd like it to be conditional on the type of user.

Instead you'll want to override the `get_renderers()` method on the view, to conditionally include BrowsableAPIRenderer or not.

Something along these lines:

    def get_renderers(self):

        if self.request.user.is_staff:

            renderer_classes = [JSONRenderer, BrowsableAPIRenderer]

        else:

            renderer_classes = [JSONRenderer]

        return [renderer_class() for renderer_class in renderer_classes]

If you put that behaviour in a mixin class you can easily include it in all your views.

Hope that helps.

  Tom

[Thomas Ruffie]

Thanks! I'll give that a try.
Otherwise I'll just remove it entirely in production.
Cheers.

--
You received this message because you are subscribed to a topic in the Google Groups "Django REST framework" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/django-rest-framework/C4-PnzudXk8/unsubscribe.
To unsubscribe from this group and all its topics, send an email to django-rest-fram...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

--
Thomas Ruffie

"Chaos was the law of Nature; Order was the dream of Man"

[Umesh K]

were to call this get_renderer()