Referencing this tutorial, I am trying to create a page with RESTful API:

        "value":"My first page"

The POST request is:

The POST request headers are:

  • Content-Type: application/hal+json
  • PHP_AUTH_USER: (admin_username)
  • PHP_AUTH_PW: (admin_password)

But Drupal responded with: 403 Forbidden (Access Denied in response HTML)

Drupal 8 is installed at: http://www.example.com/drupal/

Enabled: HAL, HTTP Basic Authentication, RESTful Web Services, Serialization, REST UI

What did I miss?

  • Did you manage to get this working? I'm having similar issues with POST and REST.
    – dibs
    Commented Feb 27, 2017 at 22:04
  • Same question as @dibs . If you have a solution, please post an answer to help others that might come across this question. Commented Nov 7, 2017 at 16:56
  • 1
    @KimberlyW IIRC I think I managed to get past this by checking an export of REST permissions and found they were empty, once corrected I started making headway with REST. Sorry if that's a bit vague, it was a while ago.
    – dibs
    Commented Nov 8, 2017 at 20:50

5 Answers 5


The tutorial example using Dev Client is probably what is throwing you off because PHP_AUTH_USER and PHP_AUTH_PW are not valid request headers for Drupal 8 REST. The tutorial does give a curl command using the --user parameter which should do the correct behavior - add an Authorization header. I demonstrated this by manually adding that request header in User login REST format.

Content-Type: application/hal+json
Accept: application/hal+json
Authorization: Basic admin_username:admin_password
  • A bit confused. How do I set the Dev Client for authentication (if I don't use cURL)? Just type Basic admin_username:admin_password in Authorization header?
    – Raptor
    Commented Jan 5, 2016 at 2:16
  • I think that should work.
    – mradcliffe
    Commented Jan 5, 2016 at 2:53
  • 1
    I wish it's okay. Still 403 forbidden & Access denied.
    – Raptor
    Commented Jan 5, 2016 at 4:26

Had the same problem and solved it in Drupal 8.6.1 (using Postman for testing):

  1. Must use in the POST command the url like http://website.com/entity/node?_format=hal_json

  2. make sure you enabled HAL and HTTP Basic Authentication, then in the Configuration REST, Enable Content rest for POS hal_json and Basic Authentication

  3. Don't know if help but made the suggested feature in Getting a 403 error in REST & 8.2.3 has no permission set for REST for GET of content

  4. put Headers:

Authorization: Basic ....
  1. the Body raw looks like:
  "_links": {
    "type": {
      "href": "http://website.com/rest/type/node/article"
  "title":[{"value":"test article55"}],
   "body": [{"value":"test body"}]

out of the tutorial

You should create also a new authenticated user for testing purposes. If you test your API with User 0 administrator account credentials, you will likely miss permission settings that you need to be set.

have you set permissions ?? try to create a new role with one user and make sure to give the according permissions from your content type.

  • Yes, I have set the permissions ( Basic Page: Create , Basic Page: Edit Own Page, Basic: Delete Own Page) for authenticated user according to the tutorial.
    – Raptor
    Commented Jan 5, 2016 at 2:14
  • and what user do you use for PHP_AUTH ?
    – rémy
    Commented Jan 5, 2016 at 7:42
  • Already mentioned in the question. Please see above.
    – Raptor
    Commented Jan 5, 2016 at 8:23
  • don't use admin_username, but another_username ?!
    – rémy
    Commented Jan 5, 2016 at 18:22
  • 2
    Tried another authenticated user. Still the same. Frustrated...
    – Raptor
    Commented Jan 6, 2016 at 2:12

I know this question is already old but I found it while diving into a quite similar situation. In your case it could be the lack of a X-CSRF Token header which is important. As indicated in the tutorial, you must visit http://www.example.com/drupal/rest/session/token and use the returned string as value for your X-CSRF-Token header key along with your authentication credentials.


If you're getting an HTML response in spite of specifying Accept: application/hal+json, it may mean that your server is blocking the request and not even sending it to Drupal. Check your Drupal's recent log reports to see if there's any error. If there is no mention of any access denied or similar errors, then you'll probably find the error in the Apache (or any other webserver) logs.

In my case, support for PATCH and DELETE had to be explicitly enabled by putting the following in my Drupal root .htaccess file:

<IfModule mod_headers.c>
  Header always set Access-Control-Allow-Methods "POST, GET, PUT, PATCH, DELETE"

  Order allow,deny
  Allow from all

The error I got in my Apache log was this:

AH01797: client denied by server configuration:

It does seem slightly odd for POST to be disabled, but this should put you on the right track to figuring out what's going wrong.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.