class IsAuthenticatedOrReadOnly(BasePermission):
    """
    The request is authenticated as a user, or is a read-only request.
    """

def has_permission(self, request, view):
    pass
Django REST Framework — отдельные разрешения для методов