I am trying to use Drupal Webform REST. I got an error "The 'restful post webform_rest_submit' permission is required." on browser console. I have enabled modules and REST resources as mentioned. I used Authorization, the Auth generated in Postman, using basic auth. I am struggling to use 'x-csrf-token' in postman. I want to use submit the form by an anonymous user. Do I still need Authorization, will just token do not work on same-origin?

const handleSubmit = async (e) => {

    await axios({
      method: 'GET',
      url: `${baseurl.URL}/session/token`,
      headers: {
        'Accept': 'application/vnd.api+json',
    .then(response =>  response)
      console.log("CSRF TODKEN", token.data);
        method: 'post',
        url: `${baseurl.URL}/webform_rest/submit?_format=json`,
          'Accept': 'application/vnd.api+json',
          'Content-Type': 'application/json',
          'X-CSRF-Token': token.data,
          'Authorization':'Basic $S$EDSnVMXDICYbVGJ'
        data: {
          "webform_id": "contact_form",
          "email": email,
          "subject": subject,
          "message": message
    .then(response => {
      response.status === 200 && console.log("Form successfully submitted")
    .catch(err => console.log("SUBMIT FAIL ERROR ",err))```
  • 1
    Does the anonymous user have the restful post webform_rest_submit permission? All users, both anonymous and auth, need a CSRF token to submit webforms via REST. Commented Mar 25, 2022 at 15:27
  • Thank you very much, Patrick Kenny. It worked. I was missing permission to "Access POST on Webform Submit resource".
    – Rdb
    Commented Mar 25, 2022 at 18:27


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.