Determining entity field access

Plugin ID: access:field

Available since: 1.0.0

Provided tokens

Token	Description
[user]	The current user. Alias: current_user
[htmx]	Information about the current HTMX request.
[htmx:is_request]	Whether the current request was sent by HTMX ("1" or "0").
[htmx:boosted]	Whether the current request was boosted by HTMX ("1" or "0").
[htmx:history_restore]	Whether the current request is for HTMX history restoration ("1" or "0").
[htmx:target]	The value of the HX-Target request header.
[htmx:trigger]	The value of the HX-Trigger request header.
[htmx:trigger_name]	The value of the HX-Trigger-Name request header.
[htmx:current_url]	The value of the HX-Current-URL request header.
[event]	The event.
[event:entity_bundle]	The bundle of the entity.
[event:entity_id]	The entity ID, only available if the entity is not new.
[event:entity_type]	The entity type.
[event:field]	The name of the field.
[event:operation]	The operation with which the entity should be accessed, e.g. "view", "update", etc.
[event:uid]	The ID of the user account of the event.
[event]	The event.
[event:machine_name]	The machine name of the ECA event.
[session_user]	The user account that dispatched the event, regardless if ECA is processing models under a different account. This is only available if ECA is configured to always run under a specific account.
[account]	The user account of the event.
[entity]	The entity of the event.
[ENTITY_TYPE]	The entity of the event under the name of its entity type.

Fires when Drupal checks whether a user can access a specific field on an entity. This wraps Drupal's hook_entity_field_access().

Use the Set access result action to grant or deny access.

High frequency event

This event fires for every field on every entity during page rendering. Always use specific filters (entity type, bundle, field name, operation) to narrow matches and avoid performance issues.

Note: Field access operations are view and edit (not update/delete as with entity-level access).

Fields

For any successor of this event, the account that asks for access is available under the <strong>[account]</strong> token. Example: <strong>[account:uid]</strong> provides the user ID of the account.

Furthermore, following data of the event is available:<ul><li><strong>[event:operation]</strong> holds the requested operation, such as "view".</li><li><strong>[event:field]</strong> holds the machine name of the field.</li></ul>

Restrict by entity type ID — config key: entity_type_id

Example: node, taxonomy_term, user

Type: textfield · Required: no · Default: empty string

Restricts to the specified entity type (e.g., node, taxonomy_term). Comma-separated for multiple values.

Restrict by entity bundle — config key: bundle

Example: article, tags

Type: textfield · Required: no · Default: empty string

Restricts to the specified bundle (e.g., article, tags). Comma-separated for multiple values.

Restrict by operation — config key: operation

Example: view, edit

Type: textfield · Required: no · Default: empty string

Restricts to the specified operation. For field access, the operations are view and edit (not update or delete).

Restrict by field name — config key: field_name

Example: title, body, field_myfield

Type: textfield · Required: no · Default: empty string

Restricts to the specified field machine name (e.g., title, body, field_image). Comma-separated for multiple values. Highly recommended to set this to avoid triggering on every field access check.