Alter Existing Route - Bypass/override entity permission I added a custom access check to a JSON API endpoint so that only users who provide a token can POST/PATCH updates on a media endpoint.  I followed this documentation in order to alter an existing route using RouteSubscriber:alterRoutes() and a custom access check.

Everything is working properly with my custom access check.  I have a custom condition which will either forbid or allow access based on a condition:

public function access() {
   $valid = $this-&gt;validateToken($token);

   if ($valid) {
     $access = AccessResult::allowed()
   } else {
     $access = AccessResult::forbidden('The access token is invalid');
   }

   return $access;
}


If the user does not fulfill the appropriate condition, then access is denied through my custom access check.  

However, if the custom access check allows access, the default entity permissions are still being applied.  I get a 403 Forbidden error saying:

The current user is not permitted to upload a file for this field. The following permissions are required: 'administer media' OR 'create media' OR 'create [machine_name] media'


When I allow access, I want whichever user who provided the correct token to be able to create a particular entity (including anonymous users).  How do I override the entity permission system so that whoever fulfills the condition has access to create the entity?  

Can I dynamically add the permission to this user to create this particular entity for just this request?

Right now in my alterRoutes() function I am setting a requirement for my _custom_access.  Do I also need to set an additional requirement for _entity_access or _entity_create_access?
Drupal uses both route access and entity access. You need to add your access check in hook_entity_access() because the media entity module is denying create access. Use route access for non entity pages.