What sort of permissions should there be for the browsable API?

[sanchegm]

 What sort of permissions should there be for the browsable API?

• Is there a use case for a user to only have view access? Even if that is not the case now, that could be the case in the future? If so, is there information that not all users should see (contact info, member names, etc)?
• An admin user should have view and admin (edit/create/delete) permissions. But should not have access to edit/view other users/groups.
  • Create your own ModelAdmin subclass without those fields following: https://docs.djangoproject.com/en/5.0/topics/auth/customizing/#extending-the-existing-user-model
• A superuser admin will have view, admin, and edit/view users/groups permissions.

Docs:
https://www.django-rest-framework.org/tutorial/4-authentication-and-permissions/

https://www.django-rest-framework.org/api-guide/permissions/