# API fails on secondsite, worked on primary/default site
**URL:** https://meta.discourse.org/t/api-fails-on-secondsite-worked-on-primary-default-site/276937
**Category:** Development
**Tags:** rest-api
**Created:** [August 28, 2023, 8:03pm UTC](https://meta.discourse.org/t/api-fails-on-secondsite-worked-on-primary-default-site/276937 "2023-08-28T20:03:05Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@MikeNolan](https://meta.discourse.org/u/MikeNolan)
#### Post date: [August 28, 2023, 8:03pm UTC](https://meta.discourse.org/t/api-fails-on-secondsite-worked-on-primary-default-site/276937/1 "2023-08-28T20:03:05Z")
I’m splitting a site into two separate sites using the multi-site method and it’s Bang Your Head against the API time–again.
Now what I’m trying to do is inactive the users from list 1 (the default site) on list 2 (the secondsite.)
I’ve already inactivated the users on list 2 from list 1, all I changed in my PHP script was to generate a new API key on the second site, insert it into the CURL call and I’m getting Invalid\_Access errors.
Here’s an expurgated call (missing most of the API key), which is valid for this user only and global access.
curl -X PUT -H “Content-Type: multipart/form-data;” -H “Api-Key: a23…” -H “Api-Username: nolan” “[https://nu-sports.tssi.com/admin/users/4/deactivate.json/](https://nu-sports.tssi.com/admin/users/4/deactivate.json/)”
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 98 0 98 0 0 212 0 --:–:-- --:–:-- --:–:-- 4454
{“errors”:[“You are not permitted to view the requested resource.”],“error\_type”:“invalid\_access”}
What’s the secret sauce I’m missing?
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [August 29, 2023, 12:51am UTC](https://meta.discourse.org/t/api-fails-on-secondsite-worked-on-primary-default-site/276937/2 "2023-08-29T00:51:29Z")
Did you make a new api key on the second site? Like like the key is invalid.
---
### Author:  [@MikeNolan](https://meta.discourse.org/u/MikeNolan)
#### Post date: [August 29, 2023, 1:02am UTC](https://meta.discourse.org/t/api-fails-on-secondsite-worked-on-primary-default-site/276937/3 "2023-08-29T01:02:58Z")
Yeah, I tried two different new keys, no dice.
If it is logging the error, I’m not spotting where.
It is apparently accessing the right key according to the API menu:
a233… deactivating huskerlist subscribers [ ](https://nu-sports.tssi.com/admin/users/2/nolan) 6 hours 1 min
---
### Author:  [@MikeNolan](https://meta.discourse.org/u/MikeNolan)
#### Post date: [August 29, 2023, 2:30am UTC](https://meta.discourse.org/t/api-fails-on-secondsite-worked-on-primary-default-site/276937/4 "2023-08-29T02:30:29Z")
I also tried creating an API key for the system user, same error.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [August 29, 2023, 8:11am UTC](https://meta.discourse.org/t/api-fails-on-secondsite-worked-on-primary-default-site/276937/5 "2023-08-29T08:11:48Z")
I’d try a global key and then try to reduce the scope.
---
### Author:  [@MikeNolan](https://meta.discourse.org/u/MikeNolan)
#### Post date: [August 30, 2023, 1:04am UTC](https://meta.discourse.org/t/api-fails-on-secondsite-worked-on-primary-default-site/276937/6 "2023-08-30T01:04:24Z")
As far as I can tell, there’s no option to reduce the scope of an API key so that it handles deactivations, that’s not one of the options available, but a global key doesn’t work anyway. (API’s need work, IMHO.)
I don’t know where the deactivate.json code is, a search on my server doesn’t find it, so apparently it isn’t a separate file. I’m wondering if there’s something specific about this being a secondsite that isn’t correct, because it worked great on the default site.
It would not be the first problem I’ve found with secondsites, though I"m not sure if anyone ever logged the first one as a problem, it has to do with code in an nginx config file that checks to make sure the domain name in the URL is the default one, I just comment out those lines of code whenever I do a rebuild. I reported this problem in this post:
> [@Multisite vs multiple containers](https://meta.discourse.org/t/multisite-vs-multiple-containers/175275/10):
>
> Thought I would give an update on my situation. After some study, I decided I needed a multisite setup (one container at this point) with an ‘outside’ nginx site to explain the setup and direct people and traffic to the separate discourse sites. That way I could make both sites open for read-only access (and web crawlers) without the folks on list1 having to deal with the content from list2. I may have to fiddle with robots.txt to make the web crawlers happy. The multisite setup examples wer…