Skip to main content
2026-07-29 16:01
REST API

Role-Based Access

AuthValidateErrorHard
Try Interactive Demo

What you will learn

  • Role × endpoint matrix is the most revealing test — parameterize every role against every protected endpoint
  • Test permission escalation vectors: can a member promote themselves? can an admin demote the last admin?
  • Verify explicit DENY over explicit ALLOW precedence if your auth model supports both — order matters for layered policies

Description

Test different user roles accessing restricted endpoints.

Test Scenario

// Regular user should get 403
const userResponse = await request.get('/api/v1/admin/users', {
  headers: { 'Authorization': 'Bearer ' + userToken }
});
expect(userResponse.status()).toBe(403);

// Admin should get 200
const adminResponse = await request.get('/api/v1/admin/users', {
  headers: { 'Authorization': 'Bearer ' + adminToken }
});
expect(adminResponse.status()).toBe(200);
Endpoint/api/v1/admin/users

Testing Tips

  • •Admin-only endpoints return 403 for users
  • •Check role in JWT payload
  • •Test permission escalation
// Playwright API Testing - REST
import { test, expect } from '@playwright/test';


test('REST API request', async ({ request }) => {
  const response = await request.get('/api/v1/resource');


  expect(response.ok()).toBeTruthy();
  expect(response.status()).toBe(200);


  const data = await response.json();
  expect(data).toBeDefined();
});

Challenge ID: rest-auth-permissions

2 frameworks available

API Playground

Send requests and inspect responses

Endpoint: /api/v1/admin/users

Press Enter to send