Create a couple of folders resources (including images in the activity description). Hide one of the folders. Enable "Mobile services": Plugins ► Web Services ► Mobile Create a Token for one teacher and one student enrolled in the course: Click on Site administration ► Plugins ► Web services ► Manage tokens Next, you can do a couple of CURL REST call simulating a WS client with the teacher and the student user . You need to replace the wstoken, courseid and the URL of your moodle instance curl 'http://localhost/m/stable_master/webservice/rest/server.php?moodlewsrestformat=json' --data 'courseids [0] =4&wsfunction=mod_folder_get_folders_by_courses&wstoken=12a2a65aeea2a177055e233f9e303218' Note, you can use jsonlint.com to validate and format the json returned string or append "| python -m json.tool" to automatically format the command output Confirm that As student you only see the visible folder activity and all the settings fields As a teacher you see all the folder resources In both cases you retrieve successfully the images included in the folder resource description (introfiles field)