Django REST Framework

When to reach for it. Once the API is a real part of the product rather than one endpoint. It brings serializers, viewsets, authentication schemes, permissions, pagination, filtering and a browsable interface for testing.

A serializer is to an API what a form is to a page: validation plus conversion, in both directions.

Set permissions explicitly on every viewset. The default comes from settings, and a default that allows everything is exactly the kind of thing nobody notices until it matters.

IsAuthenticatedOrReadOnly is a sensible starting point for public content that only signed-in people may change. Whatever you choose, choose it on purpose, per viewset.