So I'm giving REST a try. Installed drupal-8.0.0-beta12 in a VM. cURL works fine using curl http://testing.dev/drupal8/node/1?_format=json but I'm not sure why I'm getting a 403 error message using dev HTTP client:

enter image description here

Any ideas?

  • Did you actually supply a route with json as requirement? Like here
    – alexej_d
    Commented Jul 26, 2015 at 16:51
  • Why does cURL work while dev http client doesn't? This solution doesn't seem to be documented as well.
    – user50139
    Commented Jul 26, 2015 at 19:53

2 Answers 2


Have you got correct permissions for anonymous users to access the resource ?

testing.dev/drupal8/admin/people/permissions under the RESTFul Web Services ensure that Access GET on Content resource is ticked for Anonymous User. Clear cache and try your request again.

Also you might not have the format type exposed for that resource in your rest.settings.yml file. This file sets the supported_formats and auth. Here is what is should look like in your case:

        - hal_json
        - json
        - cookie
  • Drupal 8.2.3 ,in the admin/people/permissions page ,have no "Access GET on Content resource" under RESTful. BTW, I enabled the RestUI & other modules. & enable the Content in REST resources. Commented Dec 1, 2016 at 7:38
  • How does this work in drupal >8.2.3? I can't seem to find how to enable access to GET for anonymous users.
    – dibs
    Commented Feb 12, 2017 at 22:42

@dibs and @bluesky_still I hope this will help you guys out, if not the original poster:

I think REST UI is just a no-go for 8.2.3.

Here is what I did to get some GET and POST requests to work:

Setting up the REST configurations

You need to edit the yml for the entity type you're trying to change the REST configurations for. For example, the node entity would use rest.resource.entity.node.yml. I've been given the impression that RESTUI really just isn't useful with 8.2+, so you gotta do it by hand. Once you've created this file to your liking, you need to import it to your site.

I still can't figure out how to do this "correctly"; I don't know if you need to use the configuration importer (which will throw a UUID error) or include it in a theme or in your default settings or what. I did get the configuration to work. I ended up using the Features Module to create a feature package for REST Resource Configuration (admin/config/development/features/edit), downloaded the feature, unzipped the package, and installed the module created by the changes.

I then manually edited the config files in the created module's directory (DRUPAL_ROOT/modules/MODULE_NAME/config/install/rest.resource.entity.node.yml) to have the settings I wanted. Finally, I implemented the changes by updating the feature from the features config page (admin/config/development/features/ click on the "changed" next to the module you created, click on the checkbox next to the changes, and click "Import Changes").

There HAS to be a simpler way to handle the import, but it works for me on 8.2.3.

User Permissions

Once your REST configurations are set up, the entity types should follow the permissions you have set in /admin/people/permissions/. So, if anonymous users can view published nodes, they should be able to GET published nodes as well, etc. (At least, according to the documentation.)

If you're still having problems, you need to make sure to include the csdrToken in the header of your request.

The csrfToken

A GET request to the endpoint YOUR_SITE.DOMAIN/rest/session/token will provide you with a token which you can set as the X-CSRF-Token' header on your GET or POST request. A typical and simple example using jQuery to GET the first entry might look like this:

function getFirstNode() {
    .done(function (data) {
      var csrfToken = data;
        url: 'YOURSITE/web/node/1?_format=hal_json',
        method: 'GET',
        headers: {
          'Content-Type': 'application/hal+json',
          'X-CSRF-Token': csrfToken,
        success: function (node) {

If all else fails

I've also had success setting up GET endpoints using the Views Module. This article does a pretty good job explaining the process: http://redcrackle.com/blog/rest-export-views-drupal-8. It won't work for POST requests, but it should help.

I hope this helps. It's a really sticky problem for what should be a simple request, and the documentation does NOT do a great job of making this accessible. Good luck!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.