As admin, enable WebServices and "Mobile services": General > Advanced features Server ► Web services ► Overview Create a course without a course image in it Create a second course without a course image in it Activate guest access with password in the course: Course►Participants ► Enrolment Methods ►Enable Guest Access Add a password to the Guest enrolment method Disable the other enrolment methods Create third course with a summary image in it Create a user and enroll the user as a student in the course Create a Token for the student user: Click on Site administration ► Server ► Web services ► Manage tokens User: the student enrolled in step 4 Service: Moodle mobile web service Next, you should do some CURL REST calling simulating a WS client with the student user. You need to replace the wstoken, coursename is the shortname of the course without summary image created in step 2, and the URL of your moodle instance curl 'MOODLE_URL/webservice/rest/server.php?moodlewsrestformat=json' --data 'wsfunction=core_course_search_courses&wstoken=$wstoken&criterianame=search&criteriavalue=$coursename' --compressed Confirm that: You receive the course object in the response You have a param for courseimage that point to a URL similar to this:  $MOODLE_URL/pluginfile.php/$contextid/course/generated/course.svg Access and download the courseimage URL in your browser Check if you can access and see the image Access your server logs and check if there are no warnings related to accessing this image Make the same request but now change the course to the course with the guest password method created in step 3 and confirm that: You receive the course object in the response You have a param for courseimage that point to a URL similar to this:  $MOODLE_URL/pluginfile.php/$contextid/course/generated/course.svg Access and download the courseimage URL in your browser Check if you can access and see the image Access your server logs and check if there are no warnings related to accessing this image Make the same request but now change the course to the third course with a summary image created in step 4. Confirm that: You receive the course object in the response You have a param for courseimage that point to a URL similar to this:  $MOODLE_URL/pluginfile.php/$contextid/course/overviewfiles/$imagename Access and download the courseimage URL in your browser Check if you can access and see the image Access your server logs and check if there are no warnings related to accessing this image Enrol the student in the first course without the image Another CURL REST calling simulating a WS client with the student user. You need to replace the wstoken, studentid, and the URL of your moodle instance curl 'MOODLE_URL/webservice/rest/server.php?moodlewsrestformat=json' --data 'wsfunction=core_enrol_get_users_courses&wstoken=$wstoken&userid=$studentid' --compressed Confirm if the courses have courseimage following the same pattern inside the response Access and download the courseimage URL in your browser Check if you can access and see the image Access your server logs and check if there are no warnings related to accessing image Go to Site administration ► Users ► Permissions ► Define roles Choose Authenticated user and search for moodle/category:viewcourselist and set it as NOT ALLOWED. Next, do the CURL REST calling simulating a WS client with the student user. You need to replace the wstoken, coursename is the shortname of the course without summary image created in step 2, and the URL of your moodle instance curl 'MOODLE_URL/webservice/rest/server.php?moodlewsrestformat=json' --data 'wsfunction=core_course_search_courses&wstoken=$wstoken&criterianame=search&criteriavalue=$coursename' --compressed Confirm that: You receive the course object in the response Access and try to download the courseimage URL in your browser Check if you see the message: Sorry, the requested file could not be found