I am having issues sending a POST request to create a node with Drupal 8 Core REST. Here are the steps I have went through several times. Note that these steps are in effort to produce a working example, I am not worried about the security implications as of yet.

  1. Install latest version of drupal 8
  2. Enable all core web services modules (HAL, HTTP Basic Authentication, RESTful Web Services, Serialization)
  3. Go to permissions page. Find RESTful Web Services permissions and allow delete, get, patch, and post for all users. Find Node Article permissions, allow create, delete and edit for all users.
  4. Launch Dev HTTP Client in Chrome. Input the following request:

enter image description here After hitting Send, I receive the following message which I believe should be a 201 and not a 200 if a node were to successfully be created. I think the REST part is working, its just I cant seem to figure out how to get POST to create a node.

enter image description here

I am having trouble finding any documentation on making post requests to Drupal 8 REST. Insight into how to construct these requests so that Drupal can parse them successfully would be very helpful.

  • When I was fiddling with D8 REST I had to change the hal+json to json in some configuration file and then it started to work. I was never able to get hal+json format working.
    – user21641
    Apr 18 '15 at 18:17
  • do you recall what file it was you edited? did you edit it preinstallation or postinstallation? Did it result in being able to create nodes? If so what would a POST request to create an article look like?
    – Emanegux
    Apr 21 '15 at 18:03
  • drupal.org/node/2076725
    – user21641
    Apr 21 '15 at 18:51
  • I forked original module and fixed this bug and pull request. I hope accept this branch. You can download it in github.com/setali/drupal_cors Aug 27 '17 at 13:09

I posted the solution on the (identical) issue on drupal.org: https://www.drupal.org/node/2472451#comment-9903259 Also see the Dev HTTP Client screenshot attached in that comment.

Basically there are a couple of things wrong in your example:

  • endpoint is /entity/node
  • add Accept header "application/json"
  • add CSRF token (which can be requested via /rest/session/token)
  • just got the 201 from your instructions. thank you.
    – Emanegux
    May 11 '15 at 17:17
  • Accept headers are no longer used: drupal.org/node/2501221 - Instead use ?_format=json in the query string for the URL. Dec 5 '15 at 16:08
  • 2
    I tried the very same thing but, returns 415
    – Aparna
    Dec 18 '15 at 10:56
  • @tyler.frankenstein I thought post requests only accepted hal+json
    – AlxVallejo
    Jan 10 '16 at 21:55

As I still ran into a lot of 403 errors, I'll summarize my overall solution (Drupal 8.0.1).

Setup and configuration

Enable all core web services modules (HAL, HTTP Basic Authentication, RESTful Web Services, Serialization). Enable the relevant permissions of RESTful Web Services and for creating the relevant Nodes.

Get a CSRF token

GET http://your-drupal8/rest/session/token

POST to create a new node

POST http://your-drupal8/entity/node?_format=hal+json

Note that the URL for POST seems to be /entity/node rather than /node.


Authorization: Basic QWRt...
X-CSRF-Token: zCf...


"title": [
  { "value": "atest2" }
"type": [
  { "target_id": "article" }
"_links": {
  "type": { "href": "http://your-drupal8/rest/type/node/article" }
  • Couples question: 1) Do you need an authorization header if you allow anonymous users to create articles and perform post requests? 2) Don't you need a 'Content-Type': 'application/hal+json' in the header as well?
    – AlxVallejo
    Jan 10 '16 at 18:42
  • I've been trying to sort this out for ages and this still does not work for my local dev site. I have enabled | on CORS, allowed GET & POST for content in the REST-UI and I keep getting a 500. Any ideas what else could be required?
    – dibs
    Oct 5 '17 at 23:41
  • 1
    How do you get the value for the Authorization header? I thought Basic meant you pass in username:password as the value. Nov 7 '17 at 19:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.