As admin, enable "Mobile services": Site administration ► Mobile app ► Mobile settings Create a course and enrol one user as student and another one as teacher Create a database activity in the course, configured to allow comments. You can use a preset like the image gallery Log-in as the student in the site, go to the database activity and add one record. Create a Token in the mobile app service for both the student and the teacher Click on Site administration ► Plugins ► Web services ► Manage tokens Open the console an execute this new curl request, replacing wstoken with the student. The instanceid value must be replaced with the the database activity cmid (course module id) The itemid value must be replaced with the database record id (the one created by the student), it can be obtained in the database "mdl_data_records" table curl 'http://localhost/SITE/webservice/rest/server.php?moodlewsrestformat=json' --data 'wsfunction=core_comment_add_comments&wstoken=TOKEN&comments [0] [contextlevel] =module&comments [0] [instanceid] =8&comments [0] [component] =mod_data&comments [0] [content] =hello!&comments [0] [itemid] =1&comments [0] [area] =database_entry' | python -m "json.tool" Execute the curl request and confirm that: In the response you see a commentid different that 0 (save this commentid for later) In the Moodle web interface you see a new comment for the database entry "hello!" Now, execute the same curl request but using the teacher wstoken and confirm that A new comment is created, this time the teacher is the author Now, disable comments at the activity level and execute the same curl request: you will get an exception Disable comments at the site level (via Site administration > Advanced features) and execute the curl request to get a new error Additional tests: Create a new wstoken for a user not enrolled in the course where the database is and try to create a comment using the new user wstoken, you will get a no permission exception Testing deletion Enable again comments both at site and activity level. Execute the following curl request, using the student token and replacing commentid with the id of one comment created by the student curl 'http://localhost/SITE/webservice/rest/server.php?moodlewsrestformat=json' --data 'wsfunction=core_comment_delete_comments&wstoken=TOKEN&comments [0] =8' | python -m "json.tool" Confirm that in the response you see a deleted set to true and that in the web interface you don't see the comment any more Now, using the teacher wstoken execute the same curl request using a different comment created by the user (youll have to change the commentid parameter as well) Confirm that the comment is also deleted