# Adding user to group from API gets "BAD CSRF"

**URL:** <https://meta.discourse.org/t/adding-user-to-group-from-api-gets-bad-csrf/66430>\
**Category:** Development\
**Tags:** rest-api\
**Created:** [July 19, 2017, 10:11am UTC](https://meta.discourse.org/t/adding-user-to-group-from-api-gets-bad-csrf/66430 "2017-07-19T10:11:39Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![blake](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/blake/32/157322_2.png) [@blake](https://meta.discourse.org/u/blake)\
**Post date:** [July 19, 2017, 1:57pm UTC](https://meta.discourse.org/t/adding-user-to-group-from-api-gets-bad-csrf/66430/2 "2017-07-19T13:57:33Z")

</div>

You will need to change the Content-Type to multipart/form-data and use -F instead of -d

```
curl -X PUT "https://community.mysite.com/groups/42/members.json" \
-H "Content-Type: multipart/form-data;" \
-F "api_key=THE_KEY" \
-F "api_username=system" \
-F "usernames=joeuser"

```

[**-F**](https://curl.haxx.se/docs/manpage.html#-F)

> (HTTP) This lets curl emulate a filled-in form in which a user has pressed the submit button. This causes curl to POST data using the Content-Type multipart/form-data according to RFC 2388.

[**-d**](https://curl.haxx.se/docs/manpage.html#-d)

> (HTTP) Sends the specified data in a POST request to the HTTP server, in the same way that a browser does when a user has filled in an HTML form and presses the submit button. This will cause curl to pass the data to the server using the content-type application/x-www-form-urlencoded.

---

_[View the full topic](https://meta.discourse.org/t/adding-user-to-group-from-api-gets-bad-csrf/66430)._