Consider using DjangoModelPermissionsOrAnonReadOnly as default for REST Framework

[2trc]

It's on REST Framework's main page and it might help avoid simplify default configuration

REST_FRAMEWORK = {
    # Use Django's standard `django.contrib.auth` permissions,
    # or allow read-only access for unauthenticated users.
    'DEFAULT_PERMISSION_CLASSES': [
        'rest_framework.permissions.DjangoModelPermissionsOrAnonReadOnly'
    ]
}

Django REST Framework