How to override webapi.xml in custom module?

Question

I want to override /vendor/magento/module-catalog/etc/webapi.xml file in my custom module.

<route url="/V1/categories" method="GET">
        <service class="Magento\Catalog\Api\CategoryManagementInterface" method="getTree" />
        <resources>
            <resource ref="Magento_Catalog::categories" />
        </resources>
    </route>

My module path for this webapi is /app/code/CustomModule/Catalog/etc/webapi.xml

I want to override this specific code.

 <!-- Category Product Links -->
    <route url="/V1/categories/:categoryId/products" method="GET">
        <service class="Magento\Catalog\Api\CategoryLinkManagementInterface" method="getAssignedProducts" />
        <resources>
            <resource ref="anonymous" />
        </resources>
    </route>

I tried but it still gives me error

{
    "message": "Consumer is not authorized to access %resources",
    "parameters": {
        "resources": "Magento_Catalog::categories, anonymous"
    },
    "trace": "#0 /var/www/html/rb-dev/vendor/magento/
webapi/Controller/Rest/RequestValidator.php(68): 

Magento\Webapi\Controller\Rest\RequestValidator->checkPermissions()\n#1 /var/www/html/rb-dev/vendor/magento/module-webapi/Controller/Rest/InputParamsResolver.php(86): Magento\Webapi\Controller\Rest\RequestValidator->validate()\n#2 /var/www/html/rb-dev/vendor/magento/module-webapi/Controller/Rest.php(322): Magento\Webapi\Controller\Rest\InputParamsResolver->resolve()\n#3 /var/www/html/rb-dev/vendor/magento/module-webapi/Controller/Rest.php(239): Magento\Webapi\Controller\Rest->processApiRequest()\n#4 /var/www/html/rb-dev/vendor/magento/framework/Interception/Interceptor.php(58): Magento\Webapi\Controller\Rest->dispatch(Object(Magento\Framework\App\Request\Http))\n#5 /var/www/html/rb-dev/vendor/magento/framework/Interception/Interceptor.php(138): Magento\Webapi\Controller\Rest\Interceptor->___callParent('dispatch', Array)\n#6 /var/www/html/rb-dev/vendor/magento/framework/Interception/Interceptor.php(153): Magento\Webapi\Controller\Rest\Interceptor->Magento\Framework\Interception\{closure}(Object(Magento\Framework\App\Request\Http))\n#7 /var/www/html/rb-dev/generated/code/Magento/Webapi/Controller/Rest/Interceptor.php(39): Magento\Webapi\Controller\Rest\Interceptor->___callPlugins('dispatch', Array, Array)\n#8 /var/www/html/rb-dev/vendor/magento/framework/App/Http.php(135): Magento\Webapi\Controller\Rest\Interceptor->dispatch(Object(Magento\Framework\App\Request\Http))\n#9 /var/www/html/rb-dev/generated/code/Magento/Framework/App/Http/Interceptor.php(24): Magento\Framework\App\Http->launch()\n#10 /var/www/html/rb-dev/vendor/magento/framework/App/Bootstrap.php(256): Magento\Framework\App\Http\Interceptor->launch()\n#11 /var/www/html/rb-dev/index.php(39): Magento\Framework\App\Bootstrap->run(Object(Magento\Framework\App\Http\Interceptor))\n#12 {main}" }

Answer 1

For that you need to make different route url for that specific API

  <!-- Category Product Links -->
    <route url="/V1/rbcategories/:categoryId/products" method="GET">
        <service class="Magento\Catalog\Api\CategoryLinkManagementInterface" method="getAssignedProducts" />
        <resources>
            <resource ref="anonymous" />
        </resources>
    </route>

Route url is changed to <route url="/V1/rbcategories/:categoryId/products" method="GET">

it will work.

Answer 2

In addition to the accepted answer: the reason why merging your custom xml config over the existing one does not produce the desired effect is because ref is the idAttributefor <resource> nodes, and so what the xml merger does is append the new node to the list of <resources>