This: if (!$alert->canView()) { throw $this->noPermission(); } should be: if (\XF::isApiCheckingPermissions() && !$alert->canView()) { throw $this->noPermission(); }