I created my module and the entity definition using the drupal console. It has not been modified at all. My entity is for a user but for various reasons I won't be using the pre existing user entity.

I installed restui, serialization, hal, basic auth. All working fine.

I have created a REST instance for my entity using the UI; POST & GET using json+hal and basic auth.

Using curl (and Postman) I can create and retrieve a node; I can also retrieve a custom user entity that I created through the UI. All the above was easy, no dramas, took no time at all.

Then it came to creating a custom user entity. No dice. I get persistent 403's and nothing in the message (and nothing logged in watchdog which is handy.)

The auth is using an admin account (in fact 2, I created a new one in a display of desperation); admin users have all permissions by default, but I did add extra permissions to authenticated role also in the off chance that it used that internally. (More desperation.)

I'm clearing the caches every 5 minutes also.

I have sent requests using the X-CSRF-Token header using a mix of fresh and old tokens (ie, requesting new ones before a full request and then trying old ones also). Anybody know how often we should be retrieving new tokens?

I've also tried with no tokens.

The issue is that I have no idea where this is falling over, so all I can do is flail my arms around in a vain attempt at hitting something useful (I'm sure this was a dungeons and dragons action?)

The body of my POST request has been changed also, but I'm not convinced that it would throw a 403 if incorrect, I'd assume a 'malformed' response would come back or at least a non 403. Can anybody confirm?

As my entity was created by the console and I can see all the CRUD permissions enabled on my admin roles, where can I go from here?

1 Answer 1


The answer is quite simple but easy to miss.

The URL I used when I made the GET request; http://apps.dev/app/apps_user/1?_format=hal_json is not the same as the URL required to make POST requests.

To make a POST request, you change it to http://apps.dev/entity/apps_user?_format=hal_json

None of the URL's in the returned _links property are correct for POST requests.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.