I'm working on a quick script as a proof of concept to POST content to my Drupal instance using the REST API.
The user I'm trying to post as is an Administrator, but I get an error that they don't have permission to create the Content.
Here's the simple script I'm using so far (removed a lot of debug and extra code for brevity). It gets a CSRF token, constructs the JSON body and POST's the request to the REST endpoint to create a piece of content of the game
type.
<?php
$autoloader = require_once __DIR__ . '/../../vendor/autoload.php';
use GuzzleHttp\Client;
$client = new Client([ 'base_uri' => $url ]);
$csrfResponse = $client->request('GET', '/rest/session/token');
$csrfToken = trim($csrfResponse->getBody());
$jsonPayload = [
'type' => 'game',
'title' => [[ 'value' => 'Test Game ' . strtotime('now') ]],
];
$postResponse = $client->request('POST', '/entity/node?_format=json', [
'auth' => [$user, $password],
'body' => json_encode($jsonPayload),
'headers' => [
'Content-Type' => 'application/json',
'X-CSRF-Token' => $csrfToken
]
]);
debug("Status Code: " . $postResponse->getStatusCode());
debug($postResponse->getBody());
Problem: I get 403 Forbidden
response telling me:
{"message":"You are not authorized to create this node entity of bundle game."}
This despite the fact that the user is an Admin (and I even tried giving them explicit permission to Create and Review contents of the Game type). I get the same error if I put in a bogus username and password as well.
The answers suggested in the related question about "403 Forbidden when creating a page with RESTful API" did not work for me.