DRF-权限类别传回401

Question

我编写了以下代码：

class FixtureViewSet(viewsets.ReadOnlyModelViewSet):
    """
    API endpoint that allows fixture to be viewed or edited.
    """
    serializer_class = FixtureSerializer
    permission_classes = [permissions.IsAuthenticated]
    search_fields = ["home__name", "away__name"]
    filter_backends = [django_filters.rest_framework.DjangoFilterBackend, filters.SearchFilter]
    filterset_fields = ("home", "away", "id", "league")


    @action(detail=False, methods=['get'], permission_classes=[permissions.AllowAny,])
    def statistics(self, request):
        tip_count = len(Tip.objects.all())
        profit = Tip.objects.all().aggregate(Sum('pl'))["pl__sum"]

        return Response({'results': {
            'profit': profit,
            'tips': tip_count
        }})

使用相应的路线：

path('api/fixtures/statistics', views.FixtureViewSet.as_view({'get': 'statistics'})),

当我发出请求时，它总是返回401权限被拒绝，但是在'@action'装饰器中，我将Permissions_classes设置为'AllowAny'，我在这里做什么错了？