the modules Group 2, Jsonapi , Media and Groupmedia are used in a Drupal 10 installation. Group media (image) should be read out with Jsonapi.

Example of the Jsonapi call for a single image in a group.

https://mylocal.dev/jsonapi/media/ima/7a83ef89-e742-45a9-b744-6d3a4f0d8c7c/field_media_image_1?resourceVersion=id%3A3

If the admin is logged into the web browser, the Jsonapi call returns the image data correctly. If the call is made in an anonymous window, a 403 error is returned.
“errors”: [
{
“title”: “Forbidden”,
“status”: “403”,
“detail”: “The current user is not allowed to view this relationship.”,

The permissions to view media in the groups are set for Guest/Anonymous.

I have seen that the permissions are checked in the class “EntityAccessChecker” of Jsonapi, namely in the function

public function getAccessCheckedResourceObject(EntityInterface $entity, AccountInterface $account = NULL)

My thought was whether I can override this EntityAccessCheck with a custom module for specific routes or entity types. Does anyone have an idea?

Thanks, rhodes