It is possible to access a disabled resource via the include parameter, related routes and relationship routes.
When the field is a single field, the related route results in a 500 Internal Server Error with the detail, "Route \"jsonapi.user--user.individual\" does not exist."
This was uncovered as part of #2932035: ResourceTypes should be internal when EntityType::isInternal is TRUE → .
... I just noticed that the UI says: "Disabling a resource can have unexpected results when following relationships belonging to that resource."
Since this throws a 500, I still think it's worth reporting.
Fixed
1.0
Code
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.
I created an issue for the opposite requirement: Being able to add the reference data (like it was a scalar field value and not an entity reference), even if the target entity type resource is disabled, so it can't be requested directly: 📌 Disabled resources vs. includes (for referenced data) Active
Would be great to have your feedback!