Uploading an image with JSON:API; getting "Access denied"

Question

I'm attempting to upload an image with JSON:API.

I have added an Image field (not a media field) to the user entity.

In Postman, I get a session cookie for testing.

Then, in accordance with Flow 2 in the JSON:API upload file documentation, I configure my request:

I added image data as a binary to the request body.

However, when I send the request, I get the following error:

    "title": "Forbidden",
    "status": "403",
    "detail": "The current user is not permitted to upload a file for this field. The 'administer users' permission is required.",

I don't know why it is saying I need administer users permission.

When I log in as the same (authenticated, non-admin) user and then go to the user edit page, I can edit the image field (save a new image, remove the existing image) without any problem. So why am I getting a permissions error in JSON:API? I thought JSON:API permissions were supposed to be exactly the same as in the Drupal UI.

Answer 1

I wasn't able to get it working with Flow 2 in the docs; I kept getting a Needs "administer users" permission error (which is incorrect; users have permission to edit the field).

So instead, I used Flow 1:

POST /jsonapi/node/article/{uuid}/field_image HTTP/1.1
Content-Type: application/octet-stream
Accept: application/vnd.api+json
Content-Disposition: file; filename="filename.jpg"

[… binary file data …]

This requires the user to already be created, which is OK for my user case, but may not be the case for everyone.

Additional notes

• I had to turn off the popular Filefield Paths module for my image field because it breaks JSON:API.

• I had to uncheck Alt field required in the image field settings; if you leave the alt field required, you get this nasty error:

    "detail": "The controller result claims to be providing relevant cache metadata, but leaked metadata was detected. Please ensure you are not rendering content too early. Returned object class: Drupal\\Core\\Cache\\CacheableResponse.",