403 Error during multiple API calls

Development

AI-generated summary

403 Error during multiple API calls summary

Ragavan_Pitchai is experiencing 403 Forbidden errors while making API calls to update and suspend users using an admin user’s API key. The errors occur when making requests to the Suspend API and Email update API.

Ragavan_Pitchai and pfaffman attempted to resolve the issue by moving the API key from the URL to the request header. However, Ragavan_Pitchai still received a 403 Forbidden error with a “BAD CSRF” response body.

simon provided the solution: the API credentials need to be in the request header with field names changed to use dashes instead of underscores (api-key and api-username). The header field names are not case sensitive. A properly formatted API request example can be found at https://meta.discourse.org/t/discourse-api-documentation/22706.

1

We are using the following APIs to update and suspend users but we are getting 403 errors. Can you inform us what is the cause for this error. FYI, we are using API key of admin user.

Suspend API

`{{base_url}}/admin/users/316/suspend?api_key={{api_key}}&api_username={{api_username}}`

Request BODY

{
    "suspend_until": "3020-04-17",
    "reason": "inactive"
}

Response - 403 Forbidden

Email update

{{base_url}}/users/{username}/preferences/email?api_key={{api_key}}&api_username={{api_username}}

Request BODY

{
 "email": "discourse1@example.com"
}

Response - 403 Forbidden

2

You need to put the API key in the header, not the url.

3

Even tried it as well.Getting same 403 Forbidden with BODY-> [“BAD CSRF”]

4

The API credentials need to be in the request header. You also need to use a dash instead of an underscore for the header field names:

  • api_key needs to be changed to api-key (or Api-Key)
  • api_username needs to be changed to api-username (or Api-Username)

The rule is that the header field names are not case sensitive, but you need to use dashes, not underscores. (I learned this the hard way.) Have a look at the example at the top of Discourse REST API Documentation to see a properly formatted API request.