Core Docs - Supporting Rock - Secure the API

Rock Version: v19.0
Last Modified: 2026-09-28 2:05 PM

Your Rock database holds sensitive information. In Rock, sensitivity equals security. Here's how to secure your REST API endpoints.

See the Rest Controllers settings at Admin Tools > Settings > Security > REST Controllers. Select ti ti-lock to configure the settings.

You will notice that a different settings page pops up depending on whether you are securing a v1 or v2 API controller.

v1 API

v1 controllers use Rock's standard View, Edit and Administrate permissions (see Handle Permissions). Rock checks each request against one of them based on the kind of request:

Unlike v2, v1 controllers aren't locked down by default. Unless a controller has rules of its own, it inherits Rock's default REST security, which lets the RSR - Staff Workers, RSR - Staff Like Workers, RSR - Finance Worker and RSR - Rock Administration roles view data and denies everyone else. You can also secure a single endpoint. Rock checks the endpoint's own rules first, then falls back to its controller's rules.

v2 API

Understanding v2 API Controller Security

By default, the v2 API Controllers are locked down for all users. That’s intentional, we wanted to start with strong security so you have full control over who gets access to your data. Before you open things up, it’s important to understand what each permission does: