title: Django-rest-framework permissions for create in viewset
body: <p>I am trying to create a REST API and am stuck at user registration: basically I need to have the access token before I register.</p>
  
  <p>This is the view:</p>
  
  <pre><code>class UserViewSet(viewsets.ModelViewSet):
  
      """
      API endpoint that allows users to be viewed or edited.
      """
      queryset = User.objects.all()
      serializer_class = UserSerializer
  
      def metadata(self, request):
          """
          Don't include the view description in OPTIONS responses.
          """
          data = super(UserViewSet, self).metadata(request)
          return data
  
      def create(self, request):
          serializer = self.get_serializer(data=request.DATA, files=request.FILES)
  
          if serializer.is_valid():
              self.pre_save(serializer.object)
              self.object = serializer.save(force_insert=True)
              self.post_save(self.object, created=True)
              self.object.set_password(self.object.password)
              self.object.save()
              headers = self.get_success_headers(serializer.data)
              return Response(serializer.data, status=status.HTTP_201_CREATED,
                              headers=headers)
  
          return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
  </code></pre>
  
  <p>This is the workaround:</p>
  
  <pre><code>@api_view(['POST'])
  @permission_classes((AllowAny,))
  @csrf_exempt
  def create_auth(request, format=None):
      data = JSONParser().parse(request)
      serialized = UserSerializer(data=data)
  
      if serialized.is_valid():
          user = User.objects.create_user(
              serialized.init_data['email'],
              serialized.init_data['username'],
              serialized.init_data['password'],
          )
          user.groups = serialized.init_data['groups']
  
          user.save()
  
          serialized_user = UserSerializer(user)
          return Response(serialized_user.data, status=status.HTTP_201_CREATED, headers={"Access-Control-Allow-Origin": "http://127.0.0.1:8000/"})
      else:
          return Response(serialized._errors, status=status.HTTP_400_BAD_REQUEST, headers={"Access-Control-Allow-Origin": "http://127.0.0.1:8000/"})
  </code></pre>
  
  <p>My question is: How can I specify in the UserViewSet that for the <em>create</em> I don't require credentials? Or specify a custom authentication method? I don't want to change the authentication/permission classes for the whole viewset.</p>
  
  <p>Thanks,
  Adi</p>
  
  <p><strong>EDIT</strong>
  to clarify: unregistered users should be allowed to POST registration data and should not be allowed anything else. Authenticated users can get the user list and update their own profile...this is the default behaviour. This is why AllowAny is <strong>not</strong> an option. In my view, the proper place for this is the <em>create</em> function, but I don't get what I am supposed to override.</p>