I have been working on this issue for a couple weeks now, and I can't find a solution for the life of me. The fact that I have found no decent documentation (on Drupal's website, or anywhere else) is no help either. And the questions already on here are outdated (Services 2.x).

I'm trying to create a REST service for a Drupal Commerce backed site. For now all the service must do is allow for basic CRUD operations on the Order resource, and be secured with OAuth, OAuth 2.0 isn't necessary. It must also be called with a script on a server, so login re-directs are impossible (everything is done with 2-legged authentication).

The current stack is:

  • PHP 5.3.15
  • Drupal 7.15
  • Commerce Kickstart profile (7.x-2.0-rc1)
  • Services 7.x-3.2
  • OAuth 7.x-3.0+18-dev
  • OAuth Authentication 7.x-3.2
  • REST Server 7.x-3.2
  • Commerce Services 7.x-1.x-dev (This is the module I have added my custom Order code to)

I can kind of get the Retrieve/Index functions to work for Orders if I use an OAuth PHP library and just call the token request every time (I'm not even sure what's going on there, except that it authenticates...). If I try to POST to Orders and create an order though, I get 406 with the script, and 401 when I try a direct POST request from the REST Console in Google Chrome, even when OAuth is disabled.

This has made debugging a nightmare since I have no idea what's going on inside my create function. I tried stripping it of its order creation logic and just echo back the request payload. Still get the 406/401 errors.

I assume I get the 401 errors because orders require a user authentication (even if OAuth is turned off for the service).

I don't understand why I'm getting the 406 errors though. I accept application/json, which is what my REST server is set to return.

Orders were not being created even before I commented out the order creation logic. (Which I use elsewhere in the site effectively.)

Appreciation in advance.

  • In the past few months the services module has been updated so that you are required to send a token in the header for all POST, PUT, and DELETE requests. Make sure this is not the issue you're having: drupal.org/node/2013781 This does not affect GET requests.
    – CR47
    Commented Sep 19, 2013 at 15:09
  • I suggest checking out RESTws, this will be in D8 core.
    – the
    Commented Aug 11, 2014 at 19:51

1 Answer 1


Get requests did not need session authentication, POST, PUT, DELETE require session authentication to know the user and check if he has right permissions to complete the request or not.

Oauth authentication have many types of auth you must ensure that you are authentication the user not the an app (for example) so the request is authorized to complete.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.