As admin, enable "Mobile services": Plugins ► Web Services ► Mobile Enable badges and course badges in advanced features Create a site level badge, award this badge to one student user In a course, create a course badge, award this badge to the same student user (must be enrolled in the course) Create a Token for the student user: Click on Site administration ► Plugins ► Web services ► Manage tokens Next, you can do a CURL REST call simulating a WS client with the student user. You need to replace the wstoken, hash (the uniquehash instance value) and the URL of your moodle instance curl 'MOODLE_URL/webservice/rest/server.php?moodlewsrestformat=json' --data 'wsfunction=core_badges_get_user_badge_by_hash&wstoken=$wstoken&hash=$uniquehash' --compressed Confirm that: You receive your badge If you paste the badgeurl in a browser tab and remove the 'webservice/' from the URL, you see the badge image Now, repeat step #6 with an invalid hash Check you get a warning telling: "Cannot verify this awarded badge. This badge may have been revoked." Configure a new badge with endorsement, related badges, and alignment. Repeat step #6 (with valid hash) Check this information appears in the return. Remove the user 'moodle/badges:viewotherbadges' capability. Repeat step #6 (with valid hash) Check you get less information about the badge  Last, disable the global setting enablebadges, run the curl again Check that the Web Service return an exception