# Privacy rules ignored when data accessed via Data API

**URL:** <https://forum.bubble.io/t/privacy-rules-ignored-when-data-accessed-via-data-api/187682>\
**Category:** APIs\
**Created:** [January 22, 2022, 8:52pm UTC](https://forum.bubble.io/t/privacy-rules-ignored-when-data-accessed-via-data-api/187682 "2022-01-22T20:52:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![AAL](https://avatars.discourse-cdn.com/v4/letter/a/ea666f/32.png) [@AAL](https://forum.bubble.io/u/AAL)\
**Post date:** [January 22, 2022, 8:52pm UTC](https://forum.bubble.io/t/privacy-rules-ignored-when-data-accessed-via-data-api/187682/1 "2022-01-22T20:52:29Z")

</div>

Just realized that when making a call to the enabled Data API, privacy rules are ignored.

I’ve set “When current Users is this things Creator” as the only rule for the exposed data types and then loading entering the endpoint in a incognito window (thought the cookie might be the cause), but still, the data is sent.

I don’t think this is intended behavior. Or is it?

---

<div class="post-metadata">

**Author:** ![lindsay\_knowcode](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/lindsay_knowcode/32/92967_2.png) [@lindsay\_knowcode](https://forum.bubble.io/u/lindsay_knowcode)\
**Post date:** [January 23, 2022, 2:01am UTC](https://forum.bubble.io/t/privacy-rules-ignored-when-data-accessed-via-data-api/187682/3 "2022-01-23T02:01:08Z")

</div>

Depends on how you authenticate to the Data API. When you authenticate with an authentication token to the Data API - you have _full_ access, ie no privacy rules 😬. When you authenticate with “Create Sign up/Login API workflows” to the Data API you get the privacy rules _unless_ you tick the box “ignore privacy rules”. 🙂

Explained in the manual …

[https://manual.bubble.io/core-resources/api/introduction#authentication](https://manual.bubble.io/core-resources/api/introduction#authentication)

> Create Sign up/Login API workflows … Privacy rules will apply to this user as they would if the user was logging in the Bubble app and using it in their own browser.

---

<div class="post-metadata">

**Author:** ![AAL](https://avatars.discourse-cdn.com/v4/letter/a/ea666f/32.png) [@AAL](https://forum.bubble.io/u/AAL)\
**Post date:** [January 24, 2022, 2:56pm UTC](https://forum.bubble.io/t/privacy-rules-ignored-when-data-accessed-via-data-api/187682/4 "2022-01-24T14:56:17Z")

</div>

I understand the auth implications. The problem here is that the calls where made from an incognito window. Meaning that no auth was used, and even though there were privacy rules (i.e. someone not logged in shouldn’t be able to query the API), the api returned the full data.