title: How to set permissions per handler function with APIView?
body: <p>I am writing an API for a small school-related project using Django and Django-Rest-Framework. I am trying to figure out permissions.</p>
  
  <p>I am using APIView for my views, and am looking to set different permissions for each handler method without writing more views.</p>
  
  <p>Here is one of the views for the blog module that I have:</p>
  
  <p>(This view is used for <code>/posts/</code>)</p>
  
  <pre class="lang-py prettyprint-override"><code>from .serializers import *
  from django.db.models import Case, When
  from rest_framework.views import APIView
  from rest_framework.response import Response
  from rest_framework.decorators import permission_classes
  from rest_framework import status, permissions
  
  
  # Create your views here.
  class PostList(APIView):
      """
      API Endpoint to List Posts
      METHODS: GET, POST
      """
  
      @permission_classes([permissions.AllowAny,])
      def get(self, request, format=None):
          posts = Post.objects.all()
          serializer = PostSerializer(posts, many=True)
          return Response(serializer.data, status=status.HTTP_200_OK)
  
      @permission_classes([permissions.IsAuthenticated])
      def post(self, request, format=None):
          serializer = PostCreationSerializer(data=request.data)
          if serializer.is_valid():
              obj = serializer.save()
              data = serializer.data
              data["id"] = obj.id
              return Response(data, status=status.HTTP_201_CREATED)
          return Response(status=status.HTTP_400_BAD_REQUEST)
  </code></pre>
  
  <p>The current default is <code>permissions.IsAuthenticated</code>, though changing that would not necessarily help as  I would still need to change some permissions individually. </p>
  
  <p>So I should be able to make a GET request while not authenticated to <code>/posts/</code> and get a list of all posts, while I should get a 401 from a POST request to <code>/posts/</code>. However, even the GET request returns a 401 status code.</p>
  
  <p>What is the right way to do this... if there even is one.</p>
  
  <p><strong>Edit:</strong> Though I provided an answer to my own question, I would still like to know if there are any more correct ways to solve this.</p>