I'm working on a quick script as a proof of concept to POST content to my Drupal instance using the REST API.

The user I'm trying to post as is an Administrator, but I get an error that they don't have permission to create the Content.

Here's the simple script I'm using so far (removed a lot of debug and extra code for brevity). It gets a CSRF token, constructs the JSON body and POST's the request to the REST endpoint to create a piece of content of the game type.


$autoloader = require_once __DIR__ . '/../../vendor/autoload.php';
use GuzzleHttp\Client;

$client = new Client([ 'base_uri' => $url ]);

$csrfResponse = $client->request('GET', '/rest/session/token');
$csrfToken = trim($csrfResponse->getBody());

$jsonPayload = [
    'type' => 'game',
    'title' => [[ 'value' => 'Test Game ' . strtotime('now') ]],

$postResponse = $client->request('POST', '/entity/node?_format=json', [
    'auth' => [$user, $password],
    'body' => json_encode($jsonPayload),
    'headers' => [
        'Content-Type' => 'application/json',
        'X-CSRF-Token' => $csrfToken

debug("Status Code: " . $postResponse->getStatusCode());

Problem: I get 403 Forbidden response telling me:

{"message":"You are not authorized to create this node entity of bundle game."}

This despite the fact that the user is an Admin (and I even tried giving them explicit permission to Create and Review contents of the Game type). I get the same error if I put in a bogus username and password as well.

The answers suggested in the related question about "403 Forbidden when creating a page with RESTful API" did not work for me.

1 Answer 1


My problem was that the Basic Auth module was not enabled. I only found that out by chance as I was scrolling through the enabled modules, as the error message above didn't indicate how authentication was being done.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.