I have a list (used as a lookup) that I don't want users to be able to see or get access to any of the view pages to see the items in the list.
I have a form on another site that populates a drop down after a REST call is made to this list.
This REST call is returning nothing for users because I obviously haven't given them access to the list.
Is there any way to allow users to access items in the list but restrict this to REST calls only?
REST is only going to give the users results to what they have access to (I'm surprised the lookup column actually works as they currently don't have access to the data). If you don't give them permission, they won't see it.
Set unique permissions on the list so everyone has read access, except for a group that will be responsible for maintaining the data. If you want, you can mark it hidden, but you'll need to provide a link somewhere so admins can manage the list.
