# Adding user to group from API gets "BAD CSRF"

**URL:** https://meta.discourse.org/t/adding-user-to-group-from-api-gets-bad-csrf/66430
**Category:** Development
**Tags:** rest-api
**Created:** [July 19, 2017, 10:11am UTC](https://meta.discourse.org/t/adding-user-to-group-from-api-gets-bad-csrf/66430 "2017-07-19T10:11:39Z")
**Posts on this page:** 1
**Showing post:** 3

<div class="post-metadata">

### Author: ![pfaffman](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pfaffman/32/120154_2.png) [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [July 19, 2017, 2:24pm UTC](https://meta.discourse.org/t/adding-user-to-group-from-api-gets-bad-csrf/66430/3 "2017-07-19T14:24:40Z")

</div>

That’s pretty much it. In spite of what the [docs](http://docs.discourse.org/#tag/Groups%2Fpaths%2F~1groups~1%7Bgroup_id%7D~1members.json%2Fput) seem to imply, you can’t send JSON data, but only form-encoded data. [This thread](https://meta.discourse.org/t/json-vs-url-encoded-api-calls-json-returns-bad-csrf/22406) tipped me off & then I checked what was happening in the browser. I’m really trying to do this from PHP, but when that didn’t work, I fell back to `curl`.

For me the take-home message is that one should start with [reverse engineering the AP](https://meta.discourse.org/t/how-to-reverse-engineer-the-discourse-api/20576)I rather than looking at the docs.

---

_[View the full topic](https://meta.discourse.org/t/adding-user-to-group-from-api-gets-bad-csrf/66430)._