# Cant update email via API - invalid\_access error
**URL:** https://meta.discourse.org/t/cant-update-email-via-api-invalid-access-error/87260
**Category:** Development
**Created:** [5월 11, 2018, 1:06오후 UTC](https://meta.discourse.org/t/cant-update-email-via-api-invalid-access-error/87260 "2018-05-11T13:06:08Z")
**Posts on this page:** 15
**Page:** 1
### Author:  [@shahidmir](https://meta.discourse.org/u/shahidmir)
#### Post date: [5월 11, 2018, 1:06오후 UTC](https://meta.discourse.org/t/cant-update-email-via-api-invalid-access-error/87260/1 "2018-05-11T13:06:08Z")
Hi Guys,
Im getting an error when trying to use the API to update email.
I have looked at the logs and can see the following:
`Started PUT “/discussion/users/davetest/preferences/email.json” for xx.xx.xx.xx at 2018-05-11 12:22:11 +0000`
Processing by UsersEmailController#update as JSON
`Parameters: {“api_key”=>;"[FILTERED]", “api_username”=>;“daveAdmin”, “email”=>;“[new.email@example.com](mailto:new.email@example.com)”, “username”=>;“davetest”}`
Can’t verify CSRF token authenticity.
This is a PUT request, but looking at the scopes below, doesnt seem like PUT is supported for the WRITE scope? surely im misunderstanding, so could someone please assist?
I have re-generated the all-user api-key, also created specific user api-keys to use, but same result.
```
SCOPES = {
read: [:get],
write: [:get, :post, :patch],
message_bus: [[:post, ‘message_bus’]],
push: nil,
notifications: [[:post, ‘message_bus’], [:get, ‘notifications#index’], [:put, ‘notifications#mark_read’]],
session_info: [[:get, ‘session#current’], [:get, ‘users#topic_tracking_state’]]
}
```
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [5월 11, 2018, 3:43오후 UTC](https://meta.discourse.org/t/cant-update-email-via-api-invalid-access-error/87260/2 "2018-05-11T15:43:54Z")
> [@shahidmir](#):
>
> Can’t verify CSRF token authenticity.
Can you verify the content-type that you are making the API request as? It needs to be
```
"Content-Type: multipart/form-data;"
```
If it is not that content type you may see the CSRF token error.
---
### Author:  [@shahidmir](https://meta.discourse.org/u/shahidmir)
#### Post date: [5월 11, 2018, 3:48오후 UTC](https://meta.discourse.org/t/cant-update-email-via-api-invalid-access-error/87260/3 "2018-05-11T15:48:42Z")
Hi, thanks for the reply.
I actually had tried it both with ‘application/json’ and ‘application/x-www-form-urlencoded’ and neither worked. I have now tried it with what you suggested (via postman) and getting:
“You are not permitted to view the requested resource. The API username or key is invalid.”
I have regenerated the global api key that is used for “all users” and using it with my own username, which is an admin too…
shahid
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [5월 11, 2018, 3:57오후 UTC](https://meta.discourse.org/t/cant-update-email-via-api-invalid-access-error/87260/4 "2018-05-11T15:57:53Z")
Here is an example of my postman request maybe you can spot any differences with what you are doing? I’m also using the “all users” key with an admin username.
---
### Author:  [@shahidmir](https://meta.discourse.org/u/shahidmir)
#### Post date: [5월 11, 2018, 4:09오후 UTC](https://meta.discourse.org/t/cant-update-email-via-api-invalid-access-error/87260/5 "2018-05-11T16:09:14Z")
yes, its the same, im using the Postman API collection supplied by discourse. So using it as suggested. I will try again tonight and see if i get any different results. Will update when ive tried. Thanks for assisting, much appreciated. Do let me know if you have any other idea.
---
### Author:  [@simonv3](https://meta.discourse.org/u/simonv3)
#### Post date: [8월 12, 2019, 1:34오전 UTC](https://meta.discourse.org/t/cant-update-email-via-api-invalid-access-error/87260/6 "2019-08-12T01:34:06Z")
I’m experiencing this issue too and I’m wondering if it has anything to do with using an oauth provider for signing in and so this specific page is being blocked?
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [8월 12, 2019, 1:38오전 UTC](https://meta.discourse.org/t/cant-update-email-via-api-invalid-access-error/87260/7 "2019-08-12T01:38:10Z")
It most likely isn’t the oauth provider because the api keys will bypass it.
Could you share the code for your API request?
---
### Author:  [@simonv3](https://meta.discourse.org/u/simonv3)
#### Post date: [8월 12, 2019, 1:40오전 UTC](https://meta.discourse.org/t/cant-update-email-via-api-invalid-access-error/87260/8 "2019-08-12T01:40:24Z")
in python:
```plaintext
import json
import requests
import time
my_token = ''
url_base = '<>'
update_email = url_base + "users//preferences/email.json"
headers = {
"Content-Type": "multipart/form-data",
'user-agent': 'my-app/0.0.1',
'Api-Key': my_token,
'Api-Username': ''
}
data = {
"email": ""
}
response = requests.put(update_email, data=data, headers=headers)
print(response.text)
```
Edit: very similar code for setting groups on users etc worked, so the key / username combo (which is a user with admin privileges) works.
Edit 2: I’m guessing from other browsing in the forum that this has to be done directly in the database, (or rather, via the console) which is impossible for us.
---
### Author:  [@simonv3](https://meta.discourse.org/u/simonv3)
#### Post date: [8월 22, 2019, 12:28오전 UTC](https://meta.discourse.org/t/cant-update-email-via-api-invalid-access-error/87260/9 "2019-08-22T00:28:35Z")
Any more thoughts on this? My feeling is that someone with admin access rights should be able to set the e-mail of a person.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [8월 22, 2019, 12:33오전 UTC](https://meta.discourse.org/t/cant-update-email-via-api-invalid-access-error/87260/10 "2019-08-22T00:33:02Z")
How so? I don’t think this is possible with the existing web UI, which defines the API. Therefore it can’t be done.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [8월 22, 2019, 10:41오후 UTC](https://meta.discourse.org/t/cant-update-email-via-api-invalid-access-error/87260/11 "2019-08-22T22:41:26Z")
You mean that the UX/API _should_ make it possible to set a user’s email address to whatever you want. (Not that you believe that it is currently possible.)
You can initiate a change (via UX and I presume API) by editing their profile and entering the new address, but it won’t be changed until they click the link in their email. Is that good enough? If not, you’ll need to do it from the console or a plugin.
---
### Author:  [@simonv3](https://meta.discourse.org/u/simonv3)
#### Post date: [8월 25, 2019, 3:32오후 UTC](https://meta.discourse.org/t/cant-update-email-via-api-invalid-access-error/87260/12 "2019-08-25T15:32:49Z")
> [@pfaffman](#):
>
> You mean that the UX/API _should_ make it possible to set a user’s email address to whatever you want. (Not that you believe that it is currently possible.)
Exactly.
> [@pfaffman](#):
>
> You can initiate a change (via UX and I presume API) by editing their profile and entering the new address, but it won’t be changed until they click the link in their email. Is that good enough? If not, you’ll need to do it from the console or a plugin.
Whenever I enter something in the UX for editing the e-mail (which I can only access through the direct URL i.e. `https:///u//preferences/email`, there is no link through the user’s profile) it pops up that I can’t do this after clicking on “Change”:
And this is on my own account as an admin. I don’t get an e-mail.
---
### Author:  [@DDo](https://meta.discourse.org/u/DDo)
#### Post date: [3월 3, 2020, 4:04오후 UTC](https://meta.discourse.org/t/cant-update-email-via-api-invalid-access-error/87260/13 "2020-03-03T16:04:44Z")
이제 이 지점까지 도달했네요…
@pfaffman: 프로필에서 이메일 주소를 변경할 수 있다고 하셨는데, 그렇게 하려면 `email editable`이 설정되어 있어야 하지 않나요?
관리자나 관리용 API 호출을 통해 사용자가 이메일 주소를 변경할 수 있도록 허용하지 않는 한, 이메일 주소 변경을 시작할 방법이 없다는 것을 알게 되었습니다. 맞나요? 확인 이메일이 발송되고 사용자가 변경을 승인해야 하는 방식이라면 충분히 수용할 수 있습니다.
제 사용 사례는 다른 앱에서 API를 통해 사용자를 관리하는 것입니다. 따라서 Discourse에서만 사용자가 이메일 주소를 직접 변경하는 것은 원하지 않습니다.
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [3월 3, 2020, 4:42오후 UTC](https://meta.discourse.org/t/cant-update-email-via-api-invalid-access-error/87260/14 "2020-03-03T16:42:34Z")
> [@DDo](#):
>
> 제 사용 사례는 사용자가 다른 앱에서 API를 통해 관리되는 것입니다.
[Single Sign On](https://meta.discourse.org/t/official-single-sign-on-for-discourse-sso/13045)을 구현하고 다른 앱을 로그인 소스로 사용할 수 있을까요?
`sso overrides email`이라는 특정 SSO 설정이 여러분이 달성하려는 작업을 수행합니다. SSO를 설정한 후에는 `sync_sso` 엔드포인트를 사용해 새 이메일 주소를 전달할 수 있습니다.
---
### Author:  [@DDo](https://meta.discourse.org/u/DDo)
#### Post date: [3월 3, 2020, 5:28오후 UTC](https://meta.discourse.org/t/cant-update-email-via-api-invalid-access-error/87260/15 "2020-03-03T17:28:30Z")
@blake 감사합니다. 도전적이지만 기분 좋은 문제네요 😉
Discourse의 비밀번호를 ID 허브로 가져와야 할 텐데… 아, 정말입니다.
원래 시나리오를 3단계로 해결했습니다: 이메일 수정 가능 설정, 이메일 주소 변경 시작, 이메일 수정 불가 설정. 약간 과하게 느껴지지만 작동은 합니다.
SSO 시나리오에 대해 더 생각해 보겠습니다.