Hey folks, can I use application/json as Content-Type when updating a post via the API? The docs say I can, but I am starting to think I cannot.. I constantly get ["BAD CSRF"] and I have no clue what that means. If I need to use multipart/form-data do you folks have any pointers on how I build my put request? Particularly the data. header = CaseInsensitiveDict() header["Authorization"] = '{"api-key": "longapikey", "api-username": "myusername"}' { "post": { "raw": "Cool post, but here's an updated to the post's body", "edit_reason": "I changed this because I can." } } resp = requests.put(url, headers=headers, data=data) Thanks!

[image] pedroleaoc: When I edit the post via the GUI, there seems to be a PUT request to the topic’s URL (apart from the one that actually edits the post posts/post_id.json ) which I can’t reproduce with a limited API key, only the global. I don’t see why, however, I wouldn’t be able to edit the post via the API even without this extra PUT request that happens in the GUI. Do you have the “edit Posts” scope selected for your api key? [image]

[image] pedroleaoc: header = CaseInsensitiveDict() header["Authorization"] = '{"api-key": "longapikey", "api-username": "myusername"}' You need to send the Api-Key and Api-Username as their own headers, not in the Authorization header. Something like this should work better: header = CaseInsensitiveDict() header["Api-Key"] = 'longapikey' header["Api-Username"] = 'myusername' This looks like the same issue as your previous topic: [image] Getting ["BAD CSRF"] when updating topic via API [python] Development You are right, that’s something the tool I am using to test the API is doing and it works and that’s a problem on itself apparently: header1 = CaseInsensitiveDict() header1["Authorization"] = '{"api-key": "longapikey", "api-username": "myusername"}' header2 = {"api-key": "longapikey", "api-username": "myusername"} r = requests.get(url, headers= HEADER) When HEADER == header1, it works, when == header2, I get: {"errors":["You are not permitted to view the requested resource. The API username…

Thanks for your reply, David. That’s super weird, when I format the header the way you showed, I get: {"errors":["You are not permitted to view the requested resource. The API username or key is invalid."],"error_type":"invalid_access"} If I add the ["Authorization"], it works. That’s for a simple GET request, I still can’t do the PUT. I would expect a header that works for one operation to work for all (provided the key is global - which it is). So I am not too worried about the header at the moment - or should I be? Thanks!

[image] pedroleaoc: That’s for a simple GET request, I still can’t do the PUT . Likely something is malformed with your PUT request then if GET is working when you are doing it the wrong way with the Authorization header. It is working because you don’t have to be authorized at all the make the GET request. We don’t even look at the Authorization header if you pass it in. GET requests to public endpoints will work fine without any headers.

@pedroleaoc here is a little sample python script that demonstrates how to make authenticated requests and how to send the request data for put/post requests. # discourse-api-demo.py import requests from requests.structures import CaseInsensitiveDict # Basic GET request to a public url, no headers needed. url = "http://localhost:3000/posts/10.json" resp = requests.get(url) print(resp.status_code) print(resp.content) # GET request to a private endpoint. Authentication headers are needed. url = "http://localhost:3000/admin/users/list/active.json" headers = {'Api-Username': 'system', 'Api-Key': '5c1c57915e2...'} resp = requests.get(url, headers=headers) print(resp.status_code) print(resp.content) # PUT request with a request body url = "http://localhost:3000/posts/10.json" data = { 'raw': "Cool post, but here's an updated to the post's body", 'edit_reason': "I changed this because I can." } resp = requests.put(url, headers=headers, json=data) print(resp.status_code) print(resp.content) From Quickstart — Requests 2.34.2 documentation Instead of encoding the dict yourself, you can also pass it directly using the json parameter (added in version 2.4.2) and it will be encoded automatically: url = 'https://api.github.com/some/endpoint' >>> payload = {'some': 'data'} >>> r = requests.post(url, json=payload) Note, the json parameter is ignored if either data or files is passed. Using the json parameter in the request will change the Content-Type in the header to application/json .

Doh, of course! Not all GETs require Authorization! That’s such a nice pointer, I will look into that. Thanks! Things that I already know by reverse engineering: api-key rather than api_key The PUT request requires "content-type": "application/x-www-form-urlencoded" The data is not in JSON (it’s encoded, although I don’t seem to find the right encoding)

[image] pedroleaoc: The PUT request requires "content-type": "application/x-www-form-urlencoded" The data is not in JSON (it’s encoded, although I don’t seem to find the right encoding) Please see my post just above this. You can use the json=data instead of the data=data format in your request and the python requests library will take care of the content-type for you and will set it as application/json which is what you should be using.

Awesome, I am now able to edit my post! Thanks for your help! There’s only one more issue, the key I am using is global. When I try with a key with write and read permissions only, I get: You are not permitted to view the requested resource. The API username or key is invalid.. When I edit the post via the GUI, there seems to be a PUT request to the topic’s URL (apart from the one that actually edits the post posts/post_id.json) which I can’t reproduce with a limited API key, only the global. I don’t see why, however, I wouldn’t be able to edit the post via the API even without this extra PUT request that happens in the GUI. EDIT: Technically, my API key covers /t/:slug/:topic_id which is where the PUT request is pointing to.

No! I don’t even have that option! Will look into that, thanks for the help once again. [image]

What's the correct `content-type` when editing posts?

Development

blake (Blake Erickson) August 10, 2021, 7:35pm 9

Do you have the “edit Posts” scope selected for your api key?

Topic		Replies	Views
Getting ["BAD CSRF"] when updating topic via API [python] Development rest-api	2	1121	August 9, 2021
"BAD CSRF" when executing PUT using API, curl, and PHP Development rest-api	5	2493	October 5, 2021
Need Help updating profile info via API Development rest-api	6	672	May 4, 2024
I'm getting bad CSRF error even after setting api keys and usernames to my headers General	2	944	April 16, 2022
Creating a topic via the API using Node.js Development	12	2540	March 30, 2020

What's the correct `content-type` when editing posts?

Related topics