# Adding user to group from API gets "BAD CSRF"

**URL:** <https://meta.discourse.org/t/adding-user-to-group-from-api-gets-bad-csrf/66430>\
**Category:** Development\
**Tags:** rest-api\
**Created:** [July 19, 2017, 10:11am UTC](https://meta.discourse.org/t/adding-user-to-group-from-api-gets-bad-csrf/66430 "2017-07-19T10:11:39Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![pfaffman](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pfaffman/32/120154_2.png) [@pfaffman](https://meta.discourse.org/u/pfaffman)\
**Post date:** [July 19, 2017, 2:36pm UTC](https://meta.discourse.org/t/adding-user-to-group-from-api-gets-bad-csrf/66430/5 "2017-07-19T14:36:06Z")

</div>

> [@blake](#):
>
> I’ll add a line to the top of the docs about using form-data but I still doubt people will read it.

Me too. I think what would need to happen is that there’d be some indication for each API call how the data is to be passed. Or maybe it never wants JSON and always wants post data & I’ve just forgotten that since the last time I did this.

---

_[View the full topic](https://meta.discourse.org/t/adding-user-to-group-from-api-gets-bad-csrf/66430)._