Enrol a couple of users as students and teacher in a course In that course, configure a complex gradebook: Include activities with outcomes (like assignment or forum), you must add first outcomes to the course (add some grades for the student user) Include grade categories and subcategories Include manual grade items Include hidden grade items (edit a grade item and hide it) Force the course language to spanish, french or another language where the decimal separator is the comma ',' and not the period '.' As admin, enable "Mobile services": Plugins ► Web Services ► Mobile Create a Token for the student and teacher users: Click on Site administration ► Plugins ► Web services ► Manage tokens Next, you can do a CURL REST call simulating a WS client with the user. You need to replace the wstoken with the student one, userid with the student one, courseid with the course one and the URL of your moodle instance curl 'http://localhost/m/stable_master/webservice/rest/server.php?moodlewsrestformat=json' --data 'courseid=14&userid=106&wsfunction=gradereport_user_get_grade_items&wstoken=ffbe3a3002f235bf9d01fd9369e10b66' | python -m "json.tool" Check that you: Receive all the grade items visible by the user, you can compare it with the Grade user report that the user should see in the Moodle web version Check that all the grade items field values are equals to the web version ones Check that the raw version for values are using the period for decimals but the formatted one the comma Now, hide one grade for the student user (in the grader report, activate edition, and in the cell for the activity/user click on the settings wheel) Execute the curl command again and check that you don't see the grade hidden Run the same curl command but using the Teacher token, and check that you can see the hidden grade Run the same curl command (teacher token) but using userid=0, you should retrieve all the users Now, you can check another security/restrictions. Like disabling grades in the course settings, using separate groups, etc..