How do you allow most devs to GET a resource, but limit who can POST, PUT and DELETE?

[#1]

How can you make it so that only a few registered applications can post, put and delete a resource, but others can read? Do you have to create different products just to make this distinction between permissions?

[guy_hagemans · Accepted solution]

So, on resource level you can still use the API Products. Although OOTB there is no validation on the HTTP Verb. So hopefuly you can distinguish the Verb by having different resources, but that might not be the case, such as;

GET /resources

POST /resource

An interesting solution to this might be this post, which doesn't even seem that much effort to implement:

https://community.apigee.com/articles/2514/how-to-restrict-api-resources-by-their-full-path-a.html