Api Platform Security (Symfony)

Use when

• Restricting who may call each operation of an API Platform resource.
• Authorization depends on the object (owner) or on the submitted data.
• Users must see only a subset of a collection.
• Fields must be hidden depending on role or ownership.

Default workflow

1. Set security per operation with is_granted(), object, and user, plus a securityMessage.
2. Move complex rules into voters: is_granted('POST_EDIT', object).
3. When the rule depends on input, use securityPostDenormalize, or securityPostValidation to run after the Validator.
4. Scope rows with a QueryCollectionExtensionInterface (and QueryItemExtensionInterface) or a state provider.
5. Hide fields with serializer groups and a decorated context builder, and guard the firewall with access_control.
6. Test both the grant and the deny case for every protected operation.