REST API and ACLs - should the API return contacts made accessible via an ACL?
When the Contact Get REST api is triggered, I can see that the permission clause for the ACL is being generated from the whereClause() funcion of CRM_ACL_API. Here a contactId(previously passed as NULL) is fetched from the session (logged in user id) and the contact from api_key is actually not taken into account. Hence a 0 is set for ContactId and ACL permissions are not respected.