Create one lesson activity protected with password in a course with a teacher and student enrolled. Add a media file to the lesson and some images in the lesson description. Enable "Mobile services": Site administration ► Mobile app ► Mobile settings Create a Token for one teacher and one student enrolled in the course: Click on Site administration ► Plugins ► Web services ► Manage tokens Next, you can do a couple of CURL REST call simulating a WS client with the teacher and the student user . You need to replace the wstoken, lessonid and the URL of your moodle instance. You must replace the password also curl 'http://localhost/m/stable_master/webservice/rest/server.php?moodlewsrestformat=json' --data 'lessonid=7&wsfunction=mod_lesson_get_lesson&password=123&wstoken=12a2a65aeea2a177055e233f9e303218&moodlewssettingfilter=true' | python -m "json.tool" Note, you can use jsonlint.com to validate and format the json returned string or append "| python -m json.tool" to automatically format the command output Confirm that As student you see all the database lesson fields except 'password', 'dependency', 'conditions', 'activitylink', 'available', 'deadline', 'timemodified', 'completionendreached', 'completiontimespent'. You should also see all the files you attached. As a teacher you see all the lesson database fields even if you use an incorrect password