def test_api_unauthorized(self):
        """
        Testing unauthorized access to MVC API
        """
        client = self.app.test_client()
        self.browser_login(client, USERNAME_READONLY, PASSWORD_READONLY)

        rv = client.post(
            "/model1view/api/create",
            data=dict(field_string="zzz"),
            follow_redirects=True,
        )
        self.assertEqual(rv.status_code, 403)

        Testing unauthorized access to MVC API
        
tests/test_mvc.py