# Anomalous API results
**URL:** https://meta.discourse.org/t/anomalous-api-results/155581
**Category:** Support
**Created:** [June 22, 2020, 3:26pm UTC](https://meta.discourse.org/t/anomalous-api-results/155581 "2020-06-22T15:26:09Z")
**Posts on this page:** 13
**Page:** 1
### Author:  [@Ryan\_NR](https://meta.discourse.org/u/Ryan_NR)
#### Post date: [June 22, 2020, 3:26pm UTC](https://meta.discourse.org/t/anomalous-api-results/155581/1 "2020-06-22T15:26:10Z")
Howdy!
I’m trying to run an API call to create a new topic. [Discourse API Docs](https://docs.discourse.org/#tag/Posts/paths/~1posts.json/post)
Using Postman I am sending in the API Key / Username / Content-Type as Headers, and JSON data in the body.
I have verified the API Username and Key are correct, but, the API call returns the HTML of our sign in page.
Is this expected? How can I work around that?
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [June 22, 2020, 4:35pm UTC](https://meta.discourse.org/t/anomalous-api-results/155581/2 "2020-06-22T16:35:15Z")
Can you please paste the `cURL` version of the API call you are trying to make?
---
### Author:  [@Ryan\_NR](https://meta.discourse.org/u/Ryan_NR)
#### Post date: [June 23, 2020, 7:05am UTC](https://meta.discourse.org/t/anomalous-api-results/155581/3 "2020-06-23T07:05:53Z")
Sure…
```plaintext
curl -X POST 'https://staging-discuss.newrelic.com/posts.json' \
-H 'Api-Username: RyanVeitch' -i \
-H 'Api-Key: My-API-Key' -i \
-H 'Content-Type: application/json' \
-d \
'{
"title": "My fancy title",
"raw": "Some random text to fill my topic",
"category": 212,
"created_at": "2020-06-22"
}'
```
In the terminal I get this output:
```plaintext
HTTP/1.1 307 Temporary Redirect
Proxied-By: Service Gateway
Strict-Transport-Security: max-age=31536000; includeSubDomains
Location: https://staging-login.newrelic.com/login?return_to=https%3A%2F%2Fstaging-discuss.newrelic.com%2Fposts.json
content-type: text/plain;charset=UTF-8
content-length: 138
Redirecting to a different URI: https://staging-login.newrelic.com/login?return_to=https%3A%2F%2Fstaging-discuss.newrelic.com%2Fposts.json%
```
---
### Author:  [@Ryan\_NR](https://meta.discourse.org/u/Ryan_NR)
#### Post date: [June 23, 2020, 3:36pm UTC](https://meta.discourse.org/t/anomalous-api-results/155581/4 "2020-06-23T15:36:48Z")
Let me know if you need anything else from my side to help in troubleshooting :smiley:
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [June 23, 2020, 5:16pm UTC](https://meta.discourse.org/t/anomalous-api-results/155581/5 "2020-06-23T17:16:16Z")
> [@Ryan\_NR](#):
>
> ```plaintext
> HTTP/1.1 307 Temporary Redirect
> Proxied-By: Service Gateway
>
> ```
Appears that you have a very custom setup with a proxy in the middle.
That is not standard Discourse behavior, so it looks like this is caused by your special proxy thing.
Maybe there is a special Header you can send to bypass the proxy? Gotta check with that product docs.
---
### Author:  [@Ryan\_NR](https://meta.discourse.org/u/Ryan_NR)
#### Post date: [June 24, 2020, 6:45am UTC](https://meta.discourse.org/t/anomalous-api-results/155581/6 "2020-06-24T06:45:09Z")
Cool! Thanks @Falco - I’ll dig in with our dev team :slight_smile:
---
### Author:  [@Ryan\_NR](https://meta.discourse.org/u/Ryan_NR)
#### Post date: [June 25, 2020, 9:31am UTC](https://meta.discourse.org/t/anomalous-api-results/155581/7 "2020-06-25T09:31:40Z")
Hey @Falco - I managed to get through the proxy but I’m now being hit by `403 BAD CSRF` Errors.
I see this thread seems kinda unfinished…
> [@Improve BAD CSRF error message when making API calls with content-type application/json](https://meta.discourse.org/t/improve-bad-csrf-error-message-when-making-api-calls-with-content-type-application-json/117136/4):
>
> Can you share with me your actual ruby code to make this request? I’m unable to reproduce this locally. Here is the Postman json call I’m making and I’m always getting a response back: [image] Also I don’t think you need the extra post["raw"] parameter. Parameters: {"title"=\>"RT @love\_se4: One of those hidden gems in the local community, you just have to try. Over 170 different gins. Proper mixologists who know h…", "raw"=\>"https://twitter.com/se23\_tweets/status/1127663613412630529"…
Do you have any thoughts on how to beat these errors?
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [June 25, 2020, 3:37pm UTC](https://meta.discourse.org/t/anomalous-api-results/155581/8 "2020-06-25T15:37:19Z")
I just tested your example curl command locally and it is working fine for me so the syntax is all correct. Is is possible the proxy is stripping some headers? That could be why you are getting the BAD CSRF errors because it can no longer read/access the api credentials.
---
### Author:  [@Ryan\_NR](https://meta.discourse.org/u/Ryan_NR)
#### Post date: [June 25, 2020, 3:51pm UTC](https://meta.discourse.org/t/anomalous-api-results/155581/9 "2020-06-25T15:51:39Z")
Thanks @blake
Our proxy is fully custom in house built and it’s a front layer to the public.
I’m VPN’d into our internal network & I’m not hitting the public URL, I’m hitting the backend (behind proxy) URL, so, the requests shouldn’t be going through the proxy.
Our staging discourse instance is v 2.3.10
Does the API behave differently on that version?
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [June 25, 2020, 4:09pm UTC](https://meta.discourse.org/t/anomalous-api-results/155581/10 "2020-06-25T16:09:10Z")
Nope, v2.3.10 still has all the header based auth stuff so it shouldn’t behave any different.
You are hitting this line:
>
which means your request is malformed in some way and it can’t detect that it is an api request.
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [June 25, 2020, 4:25pm UTC](https://meta.discourse.org/t/anomalous-api-results/155581/11 "2020-06-25T16:25:46Z")
Because this is a staging instance and not local you will have nginx or some other webserver running before it hits discourse. It’s possibly nginx is stripping some headers depending on your config. These may show up in the nginx logs.
This is the line where it reads the api credentials out of the request headers. You could also add some debug statements to this file to figure out if the headers are getting this far.
>
---
### Author:  [@Ryan\_NR](https://meta.discourse.org/u/Ryan_NR)
#### Post date: [June 25, 2020, 5:07pm UTC](https://meta.discourse.org/t/anomalous-api-results/155581/12 "2020-06-25T17:07:27Z")
@blake
Thanks! I’ll take this up with our dev team :smiley:
Appreciate your help
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [July 25, 2020, 5:07pm UTC](https://meta.discourse.org/t/anomalous-api-results/155581/13 "2020-07-25T17:07:39Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.