How to control API4 permissions for CRUD operations?
Events

The API kernel broadcasts an authorise event.

Core permission check listener

The main API permission check subscriber will respond to the event by:

$apiRequest = $event-&gt;getApiRequest();   
if ($apiRequest['version'] &lt; 4) { /* blah */ }
elseif ($apiRequest['version'] == 4) {      
  if (!$apiRequest-&gt;getCheckPermissions()) {
    $event-&gt;authorize();                    
    $event-&gt;stopPropagation();              
  }                                         
}                                           


Adding your own listener

If the core logic doesn't meet your needs, it is possible to get the symfony event dispatcher service and add either a listener (for single events) or a subscriber (for multiple events).

For example, to add a subscriber:

$subscriber = new MySubscriberClass();            
\Civi::service('dispatcher')-&gt;addSubscriber($subscriber);


When your listener/subscriber is called, then call the $event-&gt;getApiRequest() to find out the parameters you are being asked to authorise. If the event should be authorised then call $event-&gt;authorize().

SQL clauses

For actions based on get(),
the selectQuery->getAclClause() method will call $baoName::getSelectWhereClause($tableAlias) to add a where clause.

It doesn't seem possible currently to apply differing ACL logic depending on the action with this method.