Pretty sure it's too late yeah. Authentication, Permission and Throttling checks are done before calling the method handler in DRF.