# Adding user to group from API gets "BAD CSRF"
**URL:** https://meta.discourse.org/t/adding-user-to-group-from-api-gets-bad-csrf/66430
**Category:** Development
**Tags:** rest-api
**Created:** [July 19, 2017, 10:11am UTC](https://meta.discourse.org/t/adding-user-to-group-from-api-gets-bad-csrf/66430 "2017-07-19T10:11:39Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [July 19, 2017, 10:11am UTC](https://meta.discourse.org/t/adding-user-to-group-from-api-gets-bad-csrf/66430/1 "2017-07-19T10:11:39Z")
I’m trying to add a user to a group via the API. From the docs and from what I see happening when I add a user from the web browser, it appears that this should work, but I’m getting “BAD CSRF”
```plaintext
curl -H 'Content-Type: application/json' -X PUT -d '{"api_key":"THE_KEY", "api_username":"system", "usernames":"joeuser" }' https://community.mysite.com/groups/42/members.json
```
I’m stumped. Is there something obviously silly I’m doing here?
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [July 19, 2017, 1:57pm UTC](https://meta.discourse.org/t/adding-user-to-group-from-api-gets-bad-csrf/66430/2 "2017-07-19T13:57:33Z")
You will need to change the Content-Type to multipart/form-data and use -F instead of -d
```
curl -X PUT "https://community.mysite.com/groups/42/members.json" \
-H "Content-Type: multipart/form-data;" \
-F "api_key=THE_KEY" \
-F "api_username=system" \
-F "usernames=joeuser"
```
[**-F**](https://curl.haxx.se/docs/manpage.html#-F)
> (HTTP) This lets curl emulate a filled-in form in which a user has pressed the submit button. This causes curl to POST data using the Content-Type multipart/form-data according to RFC 2388.
[**-d**](https://curl.haxx.se/docs/manpage.html#-d)
> (HTTP) Sends the specified data in a POST request to the HTTP server, in the same way that a browser does when a user has filled in an HTML form and presses the submit button. This will cause curl to pass the data to the server using the content-type application/x-www-form-urlencoded.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [July 19, 2017, 2:24pm UTC](https://meta.discourse.org/t/adding-user-to-group-from-api-gets-bad-csrf/66430/3 "2017-07-19T14:24:40Z")
That’s pretty much it. In spite of what the [docs](http://docs.discourse.org/#tag/Groups%2Fpaths%2F~1groups~1%7Bgroup_id%7D~1members.json%2Fput) seem to imply, you can’t send JSON data, but only form-encoded data. [This thread](https://meta.discourse.org/t/json-vs-url-encoded-api-calls-json-returns-bad-csrf/22406) tipped me off & then I checked what was happening in the browser. I’m really trying to do this from PHP, but when that didn’t work, I fell back to `curl`.
For me the take-home message is that one should start with [reverse engineering the AP](https://meta.discourse.org/t/how-to-reverse-engineer-the-discourse-api/20576)I rather than looking at the docs.
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [July 19, 2017, 2:33pm UTC](https://meta.discourse.org/t/adding-user-to-group-from-api-gets-bad-csrf/66430/4 "2017-07-19T14:33:37Z")
I see what you mean since the examples in the [api docs](http://docs.discourse.org) are in json, but that is mostly just for readability and is more like sudo code for you to use whatever tool you desire to make api calls. I’ll add a line to the top of the docs about using form-data but I still doubt people will read it.
> [@pfaffman](#):
>
> rather than looking at the docs.
You mean these docs with the answer you were looking for? 😉
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [July 19, 2017, 2:36pm UTC](https://meta.discourse.org/t/adding-user-to-group-from-api-gets-bad-csrf/66430/5 "2017-07-19T14:36:06Z")
> [@blake](#):
>
> I’ll add a line to the top of the docs about using form-data but I still doubt people will read it.
Me too. I think what would need to happen is that there’d be some indication for each API call how the data is to be passed. Or maybe it never wants JSON and always wants post data & I’ve just forgotten that since the last time I did this.