How to get parameters in iAuthenticate class (Restler)

Question

For my API, I have a database of items and users. API calls follow the format of

POST(GET, DELETE, etc.) http://example.com/api/items/4

When a user calls an API, I'd like to be able to get the id of the item to make sure that the user actually has permission to modify the item. I'm able to get the user ID without any problem (extracting it from the OAuth2 token), but what's the best way to get the item ID, in this case 4? I would prefer to do this in the __isAllowed() function in the iAuthenticate class to keep my code clean. Is this possible?

Answer 1

Although it is possible, it will complicate the process to reject the user based on the resource at the auth class level.

I always prefer to do this at the api method level, we can still throw 401 Unauthorized from the api method once we find the requested resource does not belong to the user