Django Rest framework Viewset Permissions "create" without "list"
<p>I have the following viewset:</p>

<pre><code>class ActivityViewSet(viewsets.ModelViewSet):
    queryset = Activity.objects.all()
    serializer_class = ActivitySerializer

    def get_permissions(self):
        if self.action in ['update','partial_update','destroy','list']:
            self.permission_classes = [permissions.IsAdminUser,]
        elif self.action in ['create']:
            self.permission_classes = [permissions.IsAuthenticated,]
        else :
            self.permission_classes = [permissions.AllowAny,]
        return super(self.__class__, self).get_permissions()
</code></pre>

<p>As seen, Im trying to allow the 'create' method without allowing the 'list', for an Authenticated user (which is not an admin).
Weirdly, this Viewset results no create nor list for the Authenticated user.
Iv'e checked, just to rull off, the following code:</p>

<pre><code>class RouteOrderingDetail(mixins.CreateModelMixin, 
                   mixins.RetrieveModelMixin, 
                   mixins.DestroyModelMixin,
                   mixins.UpdateModelMixin,
                   viewsets.GenericViewSet):
    queryset = RouteOrdering.objects.all()
    serializer_class = RouteOrderingSerializer
</code></pre>

<p>This <strong>did</strong> allowed for a view in which there is create but not list (but its not usable for me, since i do need the list option avilable.</p>

<p>Hope the problem is clear. Any help will be appriciated.</p>

<p>Maybe you can try this:</p>

<pre><code>class NotCreateAndIsAdminUser(permissions.IsAdminUser):

    def has_permission(self, request, view):
        return (view.action in ['update','partial_update','destroy','list'] 
                and super(NotCreateAndIsAdminUser, self).has_permission(request, view))


class CreateAndIsAuthenticated(permissions.IsAuthenticated):

    def has_permission(self, request, view):
        return (view.action is 'create' and
                super(CreateAndIsAuthenticated, self).has_permission(request, view))

class NotSaftyMethodAndAllowAny(permissions.AllowAny)

    def has_permission(self, request, view):
        return (view.action is not in ['update','partial_update','destroy','list', 'create']
                and super(NotSaftMethodAndAllowAny, self).has_permission(request, view))


class ActivityViewSet(viewsets.ModelViewSet):
    queryset = Activity.objects.all()
    serializer_class = ActivitySerializer
    permission_classes = (NotCreateAndIsAdminUser, CreateAndIsAuthenticated, NotSaftyMethodAndAllowAny)

    def create(self, request):
        pass

    def list(self, request):
        pass
    ....
</code></pre>

<p>the references:<a href="https://github.com/tomchristie/django-rest-framework/issues/1067" rel="nofollow">Allow separate permissions per View in ViewSet</a></p>

<p>also, you might want to check out this questions which is very similar to yours,
 <a href="http://stackoverflow.com/questions/19773869/django-rest-framework-separate-permissions-per-methods">Separate permissions per methods</a></p>

<p><strong>Or</strong></p>

<p>you can do like this:</p>

<pre><code>class ActivityViewSet(viewsets.ModelViewSet):
    queryset = Activity.objects.all()
    serializer_class = ActivitySerializer

    def get_permissions(self):
        if self.action in ['update','partial_update','destroy','list']:
            # which is permissions.IsAdminUser 
            return request.user and request.user.is_staff
        elif self.action in ['create']:
            # which is permissions.IsAuthenticated
            return request.user and is_authenticated(request.user)             
        else :
            # which is permissions.AllowAny
            return true
</code></pre>

python django permissions django-rest-framework