I have developed a custom D8 REST API endpoint, and using the REST UI module, I have enabled it and set access to be allowed for the anonymous user using the permission created by REST UI. However, when I try to access the endpoint - either via Postman or with the D7 Feeds importer - I am unable to access the endpoint because I get a 403 - Forbidden return status code.

The settings for the endpoint in the REST UI settings provides the choices of basic or cookie authentication methods. Is the option of allowing anonymous access to a GET endpoint via the provided permission really doable, or is it required to actually send some type of authentication header?


1 Answer 1


So it looks like there is a core issue that doesn't permit leaving out some type of REST authentication. The easiest solution appears to be the Feeds HTTPFetcher AA (Advanced Authentication) module, as it allows you to enter your authentication credentials in the custom parser settings. The downside is that I have to create a user (and possibly a role) in D8 for this, but at least it's workable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.