# Differences on Pull Request visibility between Frontend and API

**URL:** <https://forum.gitea.com/t/differences-on-pull-request-visibility-between-frontend-and-api/12484>\
**Category:** API/SDK/Tea/HelmChart/Terraform\
**Created:** [October 7, 2026, 8:17am UTC](https://forum.gitea.com/t/differences-on-pull-request-visibility-between-frontend-and-api/12484 "2026-10-07T08:17:17Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![JpMand](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.gitea.com/jpmand/32/7382_2.png) [@JpMand](https://forum.gitea.com/u/JpMand)\
**Post date:** [October 7, 2026, 8:17am UTC](https://forum.gitea.com/t/differences-on-pull-request-visibility-between-frontend-and-api/12484/1 "2026-10-07T08:17:17Z")

</div>

Is it intended that when Gitea UI blocks reading PRs for anonymous users (not logged in), while the API still allows it? Is it only a proxy thing, or perhaps there is a security gap?

Example: [https://gitea.com/gitea/awesome-gitea](https://gitea.com/gitea/awesome-gitea)

Attempting to open the Pull Request list while not logged in, it redirects to login.

Calling the API ([https://gitea.com/api/v1/repos/gitea/awesome-gitea/pulls?state=all&page=1&limit=50](https://gitea.com/api/v1/repos/gitea/awesome-gitea/pulls?state=all&page=1&limit=50)) directly gives me all the PRs visibile, instead of giving me 401.

> I’m using the API/SDK topic since it’s related to the API, but i’m a little unsure whether it’s more fit to use General or Install/Maintain/Configure