I am having issues sending a POST request to create a node with Drupal 8 Core REST. Here are the steps I have went through several times. Note that these steps are in effort to produce a working example, I am not worried about the security implications as of yet.

  1. Install latest version of drupal 8
  2. Enable all core web services modules (HAL, HTTP Basic Authentication, RESTful Web Services, Serialization)
  3. Go to permissions page. Find RESTful Web Services permissions and allow delete, get, patch, and post for all users. Find Node Article permissions, allow create, delete and edit for all users.
  4. Launch Dev HTTP Client in Chrome. Input the following request:

enter image description here After hitting Send, I receive the following message which I believe should be a 201 and not a 200 if a node were to successfully be created. I think the REST part is working, its just I cant seem to figure out how to get POST to create a node.

enter image description here

I am having trouble finding any documentation on making post requests to Drupal 8 REST. Insight into how to construct these requests so that Drupal can parse them successfully would be very helpful.

  • When I was fiddling with D8 REST I had to change the hal+json to json in some configuration file and then it started to work. I was never able to get hal+json format working. – user21641 Apr 18 '15 at 18:17
  • do you recall what file it was you edited? did you edit it preinstallation or postinstallation? Did it result in being able to create nodes? If so what would a POST request to create an article look like? – Emanegux Apr 21 '15 at 18:03
  • drupal.org/node/2076725 – user21641 Apr 21 '15 at 18:51

I posted the solution on the (identical) issue on drupal.org: https://www.drupal.org/node/2472451#comment-9903259 Also see the Dev HTTP Client screenshot attached in that comment.

Basically there are a couple of things wrong in your example:

  • endpoint is /entity/node
  • add Accept header "application/json"
  • add CSRF token (which can be requested via /rest/session/token)
| improve this answer | |
  • just got the 201 from your instructions. thank you. – Emanegux May 11 '15 at 17:17
  • Accept headers are no longer used: drupal.org/node/2501221 - Instead use ?_format=json in the query string for the URL. – tyler.frankenstein Dec 5 '15 at 16:08
  • 2
    I tried the very same thing but, returns 415 – Aparna Dec 18 '15 at 10:56
  • @tyler.frankenstein I thought post requests only accepted hal+json – AlxVallejo Jan 10 '16 at 21:55

As I still ran into a lot of 403 Forbidden errors I'll summarize my overall solution here (Drupal 8.0.1):

1.) Setup & Configuration

Enable all core web services modules (HAL, HTTP Basic Authentication, RESTful Web Services, Serialization

Enable relevant permissions of RESTful Web Services and for creating the relevant Nodes.

2.) Get a CSRF Token:

GET http://your-drupal8/rest/session/token

3.) POST to create a new node

POST http://your-drupal8/entity/node?_format=hal+json

Note that the URL for POST seems to be /entity/node rather than /node


Authorization: Basic QWRt...
X-CSRF-Token: zCf...


"title": [
  { "value": "atest2" }
"type": [
  { "target_id": "article" }
"_links": {
  "type": { "href": "http://your-drupal8/rest/type/node/article" }
| improve this answer | |
  • Couples question: 1) Do you need an authorization header if you allow anonymous users to create articles and perform post requests? 2) Don't you need a 'Content-Type': 'application/hal+json' in the header as well? – AlxVallejo Jan 10 '16 at 18:42
  • I've been trying to sort this out for ages and this still does not work for my local dev site. I have enabled | on CORS, allowed GET & POST for content in the REST-UI and I keep getting a 500. Any ideas what else could be required? – dibs Oct 5 '17 at 23:41
  • 1
    How do you get the value for the Authorization header? I thought Basic meant you pass in username:password as the value. – The Unknown Dev Nov 7 '17 at 19:54

I forked original module and fixed this bug and pull request. I hope accept this branch. You can download it in https://github.com/setali/drupal_cors

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.