---
title: REST API Resource Modifying Data Without Authentication Check – No Author
description: "Impact Area Security Severity High Affected Element N/A ## Rule ID **SN-RESTAPI_DATAMOD_NO_AUTHOR** ## Impact Defining a REST API Resource with a data modification verb (POST/DELETE/PATCH) without authorization restrictions via ACLs is a security risk, as it allows any user with…"
url: "https://community-staging.qualityclouds.com/qcdocs/qcr/rules/rest-api-resource-modifying-data-without-authentication-check-no-author/"
updated: "2025-03-21"
category: Rules
---

# REST API Resource Modifying Data Without Authentication Check – No Author

Impact Area

Security

           Severity

High

           Affected Element

N/A

## Rule ID

**SN-RESTAPI_DATAMOD_NO_AUTHOR**

## Impact

Defining a REST API Resource with a data modification verb (POST/DELETE/PATCH) without authorization restrictions via ACLs is a security risk, as it allows any user with login credentials to modify data in your instance.

## Remediation

Ensure that all REST API Resources which can modify data have authentication and authorization checks enabled.

### Time to fix

10 min