DRF Viewset remove permission for detail route
问题 I have a basic Viewset: class UsersViewSet(viewsets.ModelViewSet): permission_classes = (OnlyStaff,) queryset = User.objects.all() serializer_class = UserSerializer It is bind to the /api/users/ endpoint. I want to create a user profile page, so I need only a particular user, so I can retrieve it from /api/users/<id>/ , but the problem is that I want /api/users/<id>/ to be allowed to anyone, but /api/users/ to keep its permission OnlyStaff , so no one can have access to the full list of users