I'm attempting to upload an image with JSON:API.

I have added an Image field (not a media field) to the user entity.

In Postman, I get a session cookie for testing.

Then, in accordance with Flow 2 in the JSON:API upload file documentation, I configure my request:

jsonapi config

I added image data as a binary to the request body.

However, when I send the request, I get the following error:

    "title": "Forbidden",
    "status": "403",
    "detail": "The current user is not permitted to upload a file for this field. The 'administer users' permission is required.",

I don't know why it is saying I need administer users permission.

When I log in as the same (authenticated, non-admin) user and then go to the user edit page, I can edit the image field (save a new image, remove the existing image) without any problem. So why am I getting a permissions error in JSON:API? I thought JSON:API permissions were supposed to be exactly the same as in the Drupal UI.

1 Answer 1


I wasn't able to get it working with Flow 2 in the docs; I kept getting a Needs "administer users" permission error (which is incorrect; users have permission to edit the field).

So instead, I used Flow 1:

POST /jsonapi/node/article/{uuid}/field_image HTTP/1.1
Content-Type: application/octet-stream
Accept: application/vnd.api+json
Content-Disposition: file; filename="filename.jpg"

[… binary file data …]

This requires the user to already be created, which is OK for my user case, but may not be the case for everyone.

Additional notes

  • I had to turn off the popular Filefield Paths module for my image field because it breaks JSON:API.

  • I had to uncheck Alt field required in the image field settings; if you leave the alt field required, you get this nasty error:

      "detail": "The controller result claims to be providing relevant cache metadata, but leaked metadata was detected. Please ensure you are not rendering content too early. Returned object class: Drupal\\Core\\Cache\\CacheableResponse.",

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.