Permission issues with Custom Content Entity exposed to REST API I hope it's not a duplicate entry.

I've recently created my Custom Content Entity within a Custom module and I'm currently having trouble with permissions. (Please see permissions below)



The permissions work perfectly when using the add/edit/delete Drupal forms. It throws a 403 if the current user has not the permission, which is great because everything is normal here.

But when I expose the Custom Content Entity via RESTui module : GET, POST, UPDATE. (please see screenshot below). Anonymous users don't get 403 and are able to create, edit. 



Are the permissions defined under mymodule.permissions.yml only for Drupal entity form ?

How do we define REST permissions for a Custom Content Entity ?

Thank you very much for your help
Actually, this was a false positive error.. I did some testing with my REST Client in Chrome (please see screenshot at the end of the paragraph) and permissions are correctly working.

The issue was related to my XHR request which was (for some reasons) keeping a valid CSRF token and because of this I appeared to be identified as admin. And of course as admin ID 1, I was granted full access on CRUD..

Sorry and thanks for your time guys!