Retrieve Only Your Own Posts

In this lesson we’ll cover how to restrict GET endpoints so an authenticated user only retrieves their own posts. By default, if your GET /posts route returns all rows from the posts table, you’ll see entries from every user, for example:

[
  {
    "title": "this is the new title",
    "content": "this is the new content",
    "published": true,
    "id": 4,
    "created_at": "2021-08-28T21:18:13.460585-04:00",
    "owner_id": 21
  },
  {
    "title": "top beaches in florida",
    "content": "something soemthing beaches",
    "published": true,
    "id": 9,
    "created_at": "2021-08-28T21:48:30.323507-04:00",
    "owner_id": 23
  }
]

Whether you return only the authenticated user’s posts or everyone’s public posts depends on your application. For example:

A private note-taking app should return only that user’s posts.
A social feed or public blog may return all public posts.

Below we show how to:

Restrict list endpoints to the current user.
Protect single-post retrieval.
Revert to public behavior when appropriate.

First, here is the Postman screenshot showing a request to GET /posts that returns an empty array when filtering by the current user (this image is kept in place exactly as in the original lesson):

A screenshot of the Postman API client in dark mode showing a "fastapi-course" workspace with requests like Get Posts, Create Post, Delete Post, and the Authorization tab set to a Bearer token using {{JWT}}. The response pane shows a 200 OK status and an empty JSON array.

Quick endpoint decision guide

Endpoint	Private-by-default behavior	Public behavior
`GET /posts`	Return `posts` where `owner_id == current_user.id`	Return all posts: `db.query(models.Post).all()`
`GET /posts/{id}`	Check `post.owner_id == current_user.id` and return 403 if not	Return the post regardless of owner
`DELETE /posts/{id}`	Check owner before deleting	Allow delete only if you intend public deletes (rare)

Ownership checks for delete (example)

When deleting a post you typically want to ensure only the owner can delete it. The example below shows a concise, correct implementation using SQLAlchemy and FastAPI:

from fastapi import APIRouter, Depends, HTTPException, status, Response
from sqlalchemy.orm import Session

from typing import List

from .. import models, schemas, oauth2
from ..database import get_db

router = APIRouter(
    prefix="/posts",
    tags=["Posts"]
)

@router.delete("/{id}", status_code=status.HTTP_204_NO_CONTENT)
def delete_post(
    id: int,
    db: Session = Depends(get_db),
    current_user: schemas.User = Depends(oauth2.get_current_user),
):
    post_query = db.query(models.Post).filter(models.Post.id == id)
    post = post_query.first()

    if post is None:
        raise HTTPException(
            status_code=status.HTTP_404_NOT_FOUND,
            detail=f"post with id: {id} does not exist"
        )

    if post.owner_id != current_user.id:
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="Not authorized to perform requested action"
        )

    post_query.delete(synchronize_session=False)
    db.commit()

    return Response(status_code=status.HTTP_204_NO_CONTENT)

This function:

Queries the post by id.
Returns 404 if not found.
Verifies ownership (post.owner_id == current_user.id).
Returns 403 if the authenticated user is not the owner.
Deletes only after the ownership check passes.

Filter `GET /posts` to return only the current user’s posts

A common mistake is filtering by the wrong column (e.g., posts.id instead of posts.owner_id) or forgetting to execute the query with .all(). Use this pattern to return only the authenticated user’s posts:

@router.get("/", response_model=List[schemas.Post])
def get_posts(
    db: Session = Depends(get_db),
    current_user: schemas.User = Depends(oauth2.get_current_user),
):
    # Return only posts that belong to the authenticated user
    posts = db.query(models.Post).filter(models.Post.owner_id == current_user.id).all()
    return posts

Common pitfalls:

Forgetting .all() returns a SQLAlchemy query object rather than a list, which will not serialize as JSON and may cause server errors.
Filtering on models.Post.id == current_user.id compares the post primary key to the user id and will typically return nothing or incorrect results.

Tip: When debugging, build the query into a variable and print it before calling .all() to inspect the generated SQL. Remove these prints in production.

Example for debugging:

query = db.query(models.Post).filter(models.Post.owner_id == current_user.id)
print(query)  # quick debug output; remove before deploying
posts = query.all()

A development server log illustrating the mistake of filtering by the wrong column might look like:

Database connection was successful!
INFO:     Started server process [27060]
INFO:     Waiting for application startup.
INFO:     Application startup complete.
INFO:     127.0.0.1:64825 - "GET /posts/ HTTP/1.1" 500 Internal Server Error
SELECT posts.id AS posts_id, posts.title AS posts_title, posts.content AS posts_content, posts.published AS posts_published, posts.created_at AS posts_created_at, posts.owner_id AS posts_owner_id FROM posts WHERE posts.id = %(id_1)s

That log shows WHERE posts.id = ... — a sign you filtered on the wrong column.

Protect `GET /posts/{id}` to allow only the owner

To ensure only the owner can retrieve a single post, use the same ownership-check pattern as with delete:

@router.get("/{id}", response_model=schemas.Post)
def get_post(
    id: int,
    db: Session = Depends(get_db),
    current_user: schemas.User = Depends(oauth2.get_current_user),
):
    post = db.query(models.Post).filter(models.Post.id == id).first()

    if post is None:
        raise HTTPException(
            status_code=status.HTTP_404_NOT_FOUND,
            detail=f"post with id: {id} was not found"
        )

    if post.owner_id != current_user.id:
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="Not authorized to perform requested action"
        )

    return post

With this in place, user A cannot access a post owned by user B; attempts return a 403 response:

{
  "detail": "Not authorized to perform requested action"
}

Apply the same ownership checks to update endpoints (PUT/PATCH) as well as DELETE.

Reverting — make posts public again

If you want posts to be public (for a social feed), remove the ownership filter and return all posts:

@router.get("/", response_model=List[schemas.Post])
def get_posts(
    db: Session = Depends(get_db),
    current_user: schemas.User = Depends(oauth2.get_current_user),
):
    posts = db.query(models.Post).all()
    return posts

To allow truly public (unauthenticated) access:

Remove the current_user dependency from the function signature altogether so a valid token is not required.
Or keep the authentication dependency but still return all posts if you want to know who is requesting (for logging, personalization, or rate limiting).

Choose behavior (private vs public) based on your app’s goals. Use ownership checks for private content and open endpoints for public content, while keeping security and auditing in mind.

Summary

To return only the authenticated user’s posts, filter by models.Post.owner_id == current_user.id and call .all() to execute the query.
Apply the same ownership verification to single-post retrieval and to mutation endpoints (update/delete).
Remove ownership checks if posts should be public; optionally remove authentication to allow unauthenticated access.

Links and references

Introduction

Python Setup

FastAPI Basics

Working with Databases

Databases with Python

Advanced FastAPI

Database Migration

Deployment

Testing

CI/CD

Retrieve Only Your Own Posts

Quick endpoint decision guide

Ownership checks for delete (example)

Filter `GET /posts` to return only the current user’s posts

Protect `GET /posts/{id}` to allow only the owner

Reverting — make posts public again

Watch Video

​Quick endpoint decision guide

​Ownership checks for delete (example)

​Filter GET /posts to return only the current user’s posts

​Protect GET /posts/{id} to allow only the owner

​Reverting — make posts public again

Watch Video

Quick endpoint decision guide

Ownership checks for delete (example)

Filter `GET /posts` to return only the current user’s posts

Protect `GET /posts/{id}` to allow only the owner

Reverting — make posts public again