I created my module and the entity definition using the drupal console. It has not been modified at all. My entity is for a user but for various reasons I won't be using the pre existing user entity.
I installed restui, serialization, hal, basic auth. All working fine.
I have created a REST instance for my entity using the UI; POST & GET using json+hal and basic auth.
Using curl (and Postman) I can create and retrieve a node; I can also retrieve a custom user entity that I created through the UI. All the above was easy, no dramas, took no time at all.
Then it came to creating a custom user entity. No dice. I get persistent 403's and nothing in the message (and nothing logged in watchdog which is handy.)
The auth is using an admin account (in fact 2, I created a new one in a display of desperation); admin users have all permissions by default, but I did add extra permissions to authenticated role also in the off chance that it used that internally. (More desperation.)
I'm clearing the caches every 5 minutes also.
I have sent requests using the X-CSRF-Token header using a mix of fresh and old tokens (ie, requesting new ones before a full request and then trying old ones also). Anybody know how often we should be retrieving new tokens?
I've also tried with no tokens.
The issue is that I have no idea where this is falling over, so all I can do is flail my arms around in a vain attempt at hitting something useful (I'm sure this was a dungeons and dragons action?)
The body of my POST request has been changed also, but I'm not convinced that it would throw a 403 if incorrect, I'd assume a 'malformed' response would come back or at least a non 403. Can anybody confirm?
As my entity was created by the console and I can see all the CRUD permissions enabled on my admin roles, where can I go from here?
