1. Enable modules (including REST UI):

enter image description here

  1. Enable the Content in REST resources:

enter image description here

  1. Give permissions on /admin/people/permissions#module-rest ??:

enter image description here

  1. Request returns 403 Forbidden error:

enter image description here

Reference: Getting a 403 error in REST

  • I suggest you to apply patch from this issue to get more meaningful error message. drupal.org/node/2808233
    – ya.teck
    Commented Dec 1, 2016 at 8:27
  • Clear your browser cache happened with me also Commented Dec 1, 2016 at 8:47
  • Daniel Serna Jeroen • 5 months ago You need also a token in the header X-CSRF-Token: <token> this token is generated by yourhost/rest/session/token hope it helps darrylnorris.com/blog/… Commented Dec 2, 2016 at 6:21
  • You may need to pass the session cookie and/or x-csrf-token header with the GET request. Commented Jan 31, 2017 at 22:02

3 Answers 3


This is a known issue with the REST UI module. REST UI has issues with Drupal 8.2 and up. There is an open issue specifically regarding this, and a much longer discussion to look into. I'd post this as a comment, rather than an answer, but I'm a new user here. Best of luck. I'm having the same problem.


I think REST UI is just a no-go for 8.2.3. Bear with me. I don't have enough reputation to post links :-/

Here is what I did to get some requests to work:

Setting up the REST configurations

In the place of step 2 above, it seems that you need to edit the yml for the entity type you're trying to change the rest configurations for. For example, the node entity would use rest.resource.entity.node.yml (look here for some help: https://www.drupal.org/docs/8/api/restful-web-services-api/restful-web-services-api-overview#practical). I've been given the impression that RESTUI really just isn't useful with 8.2+, so you gotta do it by hand. Once you've created this file to your liking, you need to import it to your site.

I still can't figure out how to do this "correctly"; I don't know if you need to use the configuration importer (which will throw a UUID error) or include it in a theme or in /default/site or what. I did get it to work. I ended up using the Features Module to create a feature package for REST Resource Configuration (admin/config/development/features/edit), downloaded, unzipped, and installed the module created by the changes.

I then manually edited the config files in the created module's directory (DRUPAL_ROOT/modules/MODULE_NAME/config/install/rest.resource.entity.node.yml) to have the settings I wanted. Finally, I implemented the changes by updating the feature from the features config page (admin/config/development/features/ click on the "changed" next to the module you created, click on the checkbox next to the changes, and click "Import Changes").

There HAS to be a simpler way to handle the import, but it works for me on 8.2.3.

User Permissions

Once your REST configurations are set up, the entity types should follow the permissions you have set in /admin/people/permissions/. So, if anonymous users can view published nodes, they should be able to GET published nodes as well, etc. (At least, according to [the documentation][1].)

If you're still having problems, you need to make sure to include the token header usually.

The csrfToken

A GET request to the endpoint YOUR_SITE.DOMAIN/rest/session/token will provide you with a token which you can set as the X-CSRF-Token' header on your GET or POST request. A typical and simple example using jQuery to GET the first entry might look like this:

function getFirstNode() {
    .done(function (data) {
      var csrfToken = data;
        url: 'YOURSITE/web/node/1?_format=hal_json',
        method: 'GET',
        headers: {
          'Content-Type': 'application/hal+json',
          'X-CSRF-Token': csrfToken,
        success: function (node) {

If all else fails

I've also had success setting up GET endpoints using the Views Module. This article does a pretty good job explaining the process: http://redcrackle.com/blog/rest-export-views-drupal-8. It won't work for POST requests, but it should help.

I hope this helps. It's a really sticky problem for what should be a simple request, and the documentation does NOT do a great job of making this accessible. Good luck!



I have found that the solution for the 403 Forbidden error is to use this combination:



Raw request body

  "_links": {
    "type": {
      "href": "http://website.com/rest/type/node/article"
  "title":[{"value":"test article55"}],
  "body": [{"value":"test body"}]


Authorization: Basic ....

I was confused by this as well. Thanks to your post and some other reading, I figured out how to get the REST API working though.

It appears the REST UI module is still not working correctly to enable the API.

So, as already mentioned in another answer, the REST config file rest/config/optional/rest.resource.entity.node.yml is required to make the REST API active in Drupal 8.2+, but it's in the optional directory, so it doesn't appear to get applied by default (even though I think it should, if the dependencies are enabled?).

The only thing I'm adding to your answer is that the easiest way I found to update and enable the rest.resource.entity.node configuration is using the drush cim command.

I copied the rest.resource.entity.node.yml to a temporary directory /app/drush/test/sync/, edited it, and imported it using this command (from the docroot):

$ drush cim --partial --source=/app/drush/test/sync/

You can check that it worked by running this command:

$ drush cget rest.resource.entity.node

In Drupal 8.2+ users should have the same permissions to access entities via the REST API as via the web (HTML). If you set the rest.settings option bc_entity_resource_permissions to true however (the old style), you will need to set access permissions for the API in the Permissions panel.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.