Repository navigation
/api/authz/features/<:string>: contract says admin-only, backend allows anonymous access #385
Description
Please describe your request
Features.md states that /api/authz/features/<:string> is "restricted to system administrators"[1], but any unauthenticated user can access it[2] as backend uses permitAll()[3]. It also describes return codes 401 Unauthorized & 403 Forbidden[4]
[1]
Lines 19 to 22 in 54bcdf6
[2]
https://sandbox.dspace.org/server/api/authz/features/canDownload
[4]
Lines 42 to 43 in 54bcdf6
Activity
lgeggleston commentedon Oct 1, 2026
Hi @MMilosz, thanks for submitting this! I think we may need some additional context for working on a fix though.
First, could you put this description into the format for a bug report?
Second, would your proposed fix be to update the RestContract to reflect the unrestricted access, or instead make sure it's actually restricted to administrators on the backend (depending on the use case for this endpoint)? We can also wait for more input from the community if unsure. Thank you!