1. Installed django rest-framework

pip install djangorestframework
                

2. REST_FRAMEWORK Settings


You can define a REST_FRAMEWORK dictionary in your settings.py file to customize how DRF behaves across your entire project.

# settings.py
REST_FRAMEWORK = {
    'DEFAULT_PERMISSION_CLASSES': [
        'rest_framework.permissions.AllowAny',
    ],
    'DEFAULT_AUTHENTICATION_CLASSES': [
        'rest_framework.authentication.SessionAuthentication',
        'rest_framework.authentication.BasicAuthentication',
    ],
# Optional: Pagination
    'DEFAULT_PAGINATION_CLASS': 'rest_framework.pagination.PageNumberPagination',
    'PAGE_SIZE': 10,
}

                  
                  

1. DEFAULT_PERMISSION_CLASSES

This sets the default permission policy for your API views.

Examples:

• 'rest_framework.permissions.AllowAny': Anyone can access the API.
• 'rest_framework.permissions.IsAuthenticated': Only authenticated users can access.
• 'rest_framework.permissions.IsAdminUser': Only admin users can access.
• 'rest_framework.permissions.DjangoModelPermissions': Uses Django's built-in model permissions.

2. DEFAULT_AUTHENTICATION_CLASSES

This sets how DRF will authenticate users.

Common options:

• 'rest_framework.authentication.SessionAuthentication': Uses Django sessions (for browser users).
• 'rest_framework.authentication.BasicAuthentication': HTTP Basic Auth (not safe for production unless HTTPS).
• 'rest_framework.authentication.TokenAuthentication': For token-based auth (requires rest_framework.authtoken).
• 'rest_framework_simplejwt.authentication.JWTAuthentication': For JWT tokens (third-party).

3. DEFAULT_PAGINATION_CLASS and PAGE_SIZE

Used to paginate large lists of data automatically.

Example:

'DEFAULT_PAGINATION_CLASS': 'rest_framework.pagination.PageNumberPagination',
'PAGE_SIZE': 10

This splits large API responses into pages. DRF adds navigation links like:

{
  "next": "http://.../api/posts/?page=2",
  "previous": null,
  "results": [...]
}

Other pagination classes:

• LimitOffsetPagination
• CursorPagination

Optional Settings You Might Use Later:

• Throttle settings (limit requests per user/IP)
• Versioning (support multiple API versions)
• Exception handling customization
• Renderers (like JSON or browsable API UI)

Creating Views and Serializers for API

1. serializers.py

In serializers.py, you'll define how the data will be serialized (converted into JSON format). A serializer is similar to a Django Form or ModelForm.

# api/serializers.py
from rest_framework import serializers
from .models import Post

class PostSerializer(serializers.ModelSerializer):
    class Meta:
        model = Post
        fields = '__all__'  # Serialize all fields of the Post model

Explanation:

• ModelSerializer: This is the most common serializer that automatically generates fields based on the Django model.
• fields = '__all__': This indicates that you want to serialize all the fields in the model. You can also specify specific fields, e.g., ['title', 'content'].

2. views.py

In views.py, you'll define the API views. DRF provides several ways to create views, including APIView, viewsets, and generic views.

Option 1: Using ViewSets (Recommended for simplicity)

ViewSets allow you to handle basic CRUD operations automatically.

# api/views.py
from rest_framework import viewsets
from .models import Post
from .serializers import PostSerializer

class PostViewSet(viewsets.ModelViewSet):
    queryset = Post.objects.all()  # Query to get all posts
    serializer_class = PostSerializer  # Specify the serializer to use

• ModelViewSet: Automatically provides implementations for CRUD operations (Create, Read, Update, Delete).

Option 2: Using APIView (Custom behavior)

If you need more custom behavior, you can use APIView to manually define the logic for each method (GET, POST, PUT, DELETE).

# api/views.py
from rest_framework.views import APIView
from rest_framework.response import Response
from rest_framework import status
from .models import Post
from .serializers import PostSerializer

class PostList(APIView):
    def get(self, request, format=None):
        posts = Post.objects.all()  # Fetch all posts
        serializer = PostSerializer(posts, many=True)  # Serialize the data
        return Response(serializer.data)  # Return as JSON

    def post(self, request, format=None):
        serializer = PostSerializer(data=request.data)  # Get data from request
        if serializer.is_valid():
            serializer.save()  # Save to database
            return Response(serializer.data, status=status.HTTP_201_CREATED)
        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)

• get(): Retrieves data.
• post(): Creates new data.

3. URLs Setup

Once your views are defined, you need to wire them up in the URLs file (urls.py).

Using ViewSet (DRF Router)

With viewsets, DRF provides a router that automatically maps the views to URLs.

# api/urls.py
from django.urls import path, include
from rest_framework.routers import DefaultRouter
from .views import PostViewSet

router = DefaultRouter()
router.register(r'posts', PostViewSet)  # Register PostViewSet for 'posts' endpoint

urlpatterns = [
    path('', include(router.urls)),  # Includes all routes from the router
]

Using APIView

If you're using APIView, manually create URL mappings.

# api/urls.py
from django.urls import path
from .views import PostList

urlpatterns = [
    path('posts/', PostList.as_view(), name='post-list'),  # Map to PostList class
]

4. Example of Testing the API

Once everything is set up, you can test the API by running the development server:

python manage.py runserver

Visit http://127.0.0.1:8000/api/posts/ to see the list of posts (if you're using PostViewSet) or http://127.0.0.1:8000/api/posts for the APIView.

Today I Learned: Custom Permissions in Django REST Framework

Django REST Framework ships with several out-of-the-box permission settings that we can use to secure our API. These permissions can be applied at different levels:

• Project-level: Set globally via settings.py
• View-level: Applied to specific views or viewsets
• Model-level: Enforced per-object using custom logic

Today, I learned how to create my own custom permission for my current project — a Blog site. I implemented a permission that ensures only the author of a blog post has the ability to update or delete it.

What This Means

By writing a custom permission class and attaching it to my viewset, I've added a layer of security to make sure that users cannot modify blog posts that they don't own. This enhances data integrity and user accountability in my app.

Custom Permissions in Django REST Framework (DRF)

What Are Custom Permissions?

Custom permissions in DRF let you define fine-grained access control for your API endpoints, going beyond the built-in permissions like IsAuthenticated or IsAdminUser.

How BasePermission Works

• BasePermission is an abstract class you subclass to create custom permissions.
• has_permission(self, request, view): checks general (view-level) access.
• has_object_permission(self, request, view, obj): checks object-specific access (e.g., for retrieve/update/delete).
• DRF calls has_permission() first, then has_object_permission() if the view is detail-based.

How to Create a Custom Permission

        # app_name/permissions.py
        from rest_framework.permissions import BasePermission
        
        class IsOwnerOrReadOnly(BasePermission):
            def has_object_permission(self, request, view, obj):
                if request.method in ['GET', 'HEAD', 'OPTIONS']:
                    return True
                return obj.owner == request.user
          

How to Use a Custom Permission in a View

        # app_name/views.py
        from rest_framework import viewsets
        from .models import Article
        from .serializers import ArticleSerializer
        from .permissions import IsOwnerOrReadOnly
        
        class ArticleViewSet(viewsets.ModelViewSet):
            queryset = Article.objects.all()
            serializer_class = ArticleSerializer
            permission_classes = [IsOwnerOrReadOnly]
          

Combining With Built-in Permissions

        from rest_framework.permissions import IsAuthenticated
        
        class ArticleViewSet(viewsets.ModelViewSet):
            ...
            permission_classes = [IsAuthenticated, IsOwnerOrReadOnly]
          

Optional: Set as Global Default in settings.py

        REST_FRAMEWORK = {
            'DEFAULT_PERMISSION_CLASSES': [
                'rest_framework.permissions.IsAuthenticated',
                'your_app.permissions.IsOwnerOrReadOnly',
            ]
        }
          

You can build more advanced permissions using custom logic inside the permission class.