# \[API\] "Não é possível verificar a autenticidade do token CSRF" ao tentar atualizar o avatar do usuário

**URL:** <https://meta.discourse.org/t/api-cant-verify-csrf-token-authenticity-when-attempting-to-update-avatar-for-user/238437>\
**Category:** Development\
**Tags:** rest-api\
**Created:** [Setembro 8, 2022, 10:32am UTC](https://meta.discourse.org/t/api-cant-verify-csrf-token-authenticity-when-attempting-to-update-avatar-for-user/238437 "2022-09-08T10:32:04Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![rxmie](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/rxmie/32/273305_2.png) [@rxmie](https://meta.discourse.org/u/rxmie)\
**Post date:** [Setembro 8, 2022, 10:32am UTC](https://meta.discourse.org/t/api-cant-verify-csrf-token-authenticity-when-attempting-to-update-avatar-for-user/238437/1 "2022-09-08T10:32:04Z")

</div>

Problema semelhante aqui - [Cant update email via API - invalid\_access error](https://meta.discourse.org/t/cant-update-email-via-api-invalid-access-error/87260)

O que vejo nos logs do servidor:

```plaintext
Started PUT "/u/brodie-16/preferences/avatar/pick.json" for 24.17.99.993 at 2022-09-08 10:28:10 +0000
Processing by UsersController#pick_avatar as JSON
  Parameters: {"upload_id"=>13, "type"=>"uploaded", "username"=>"pelican-16", "user"=>{}}
Can't verify CSRF token authenticity.
Completed 422 Unprocessable Entity in 34ms (Views: 0.3ms | ActiveRecord: 0.0ms | Allocations: 6549)

```

Solicitação que estou fazendo:

```plaintext
import requests
import json

url = "https://blah.blahblah.blah/u/brodie-16/preferences/avatar/pick.json"

payload = json.dumps({
  "upload_id": 13,
  "type": "uploaded"
})
headers = {
  'Api-Key': 'blahblahblahblahhhhh',
  'Api-Username': 'system',
}

response = requests.request("PUT", url, headers=headers, json=payload)

print(response.text)

```

Resposta que estou recebendo da API:

```plaintext
{
    "failed": "FAILED"
}

```

Sei que não está relacionado ao balanceador de carga/proxy porque nem mesmo funciona localmente a partir da instância em que estou executando o Discourse.

```plaintext
[root@ip-10-say-whatt-2 discourse]# curl --insecure --location --request PUT 'https://localhost/u/brodie-16/preferences/avatar/pick.json' \
> --header 'Api-Key: blahblah' \
> --header 'Api-Username: system' \
> --header 'Content-Type: application/json' \
> --data-raw '{
> "upload_id": 13,
> "type": "uploaded"
> }'
{"failed":"FAILED"}

```

Alguém mais postou isso recentemente também - [Can't verify CSRF token authenticity while creating topics](https://meta.discourse.org/t/cant-verify-csrf-token-authenticity-while-creating-topics/234331)

Alguém sabe o que está acontecendo?

---

_[View the full topic](https://meta.discourse.org/t/api-cant-verify-csrf-token-authenticity-when-attempting-to-update-avatar-for-user/238437)._