Expand my Community achievements bar.

Applications for the 2024-2025 Adobe Experience Manager Champion Program are open!

Assets API CRUD operations


Level 2

Hi All,


We want to use Assets API to only expose Content Fragments as JSON and not allow Create, update and delete operation.


What is the best way to block these operation? Add DENY rule in dispatcher filter on POST method for /api/assets path or any other options available?


Appreciate inputs.



3 Replies


Community Advisor

Hi @Antony6790 


You can block all the request by default and allow only the GET requests with /api/assets path and JSON as the extension.

This will ensure only fetching the asset details/retrieval of asset is allowed whereas rest all operations are blocked.


/0001 { /type "deny" /glob "*"}
/000X #other rules are here for website
/0003 { /type "allow" /method "GET" /url "/api/assets/*" /extension 'json' } #whatever path it is.




Employee Advisor

Are ACLs on the asset an option?


Level 2
We are trying to expose CF from Publisher using a separate dispatcher domain. We want to restrict at dispatcher itself before even reaching publisher.