# Getting \["BAD CSRF"\] when updating topic via API \[python\]

**URL:** https://meta.discourse.org/t/getting-bad-csrf-when-updating-topic-via-api-python/199857
**Category:** Development
**Tags:** rest-api
**Created:** [August 9, 2021, 7:25pm UTC](https://meta.discourse.org/t/getting-bad-csrf-when-updating-topic-via-api-python/199857 "2021-08-09T19:25:01Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![pedroleaoc](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pedroleaoc/32/230359_2.png) [@pedroleaoc](https://meta.discourse.org/u/pedroleaoc)
#### Post date: [August 9, 2021, 7:25pm UTC](https://meta.discourse.org/t/getting-bad-csrf-when-updating-topic-via-api-python/199857/1 "2021-08-09T19:25:01Z")

</div>

Hey folks, I am having issues updating a topic. I am able to get the `id` of the first post as shown [here](https://meta.discourse.org/t/updating-topic-body-via-the-api/61220). This is confirmed by running the following:

```python
import requests
from requests.structures import CaseInsensitiveDict

url = "https://my/discourse/instance/posts/{post_id}.json"

headers = CaseInsensitiveDict()
headers["Authorization"] = "{"api-key": "{le_api_key}", "api-username": "{le_username}"}"

resp = requests.get(url, headers=headers)

print(resp.status_code)

```

Which returns a `200` status code and the info I expected about the post.

But when I try:

```python
import requests
from requests.structures import CaseInsensitiveDict

url = "https://my/discourse/instance/posts/{post_id}.json"

headers = CaseInsensitiveDict()
headers["Authorization"] = "{"api-key": "le_api_key", "api-username": "le_username"}"
headers["Content-Type"] = "application/json"

data = """
{
  "post": {
      "raw": "Cool post, but here's an updated to the post's body",
      "edit_reason": "I changed this because I can."
   }
}
"""

resp = requests.put(url, headers=headers, data=data)

print(resp.status_code)

```

I get  
`["BAD CSRF"]`

I am an admin and my key is `global`. Ideally I would like to run this with a less permissive key.  
This post is the first and only in a topic a created via the API.

Thank you so much in advance 🙂

---

<div class="post-metadata">

### Author: ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [August 9, 2021, 7:28pm UTC](https://meta.discourse.org/t/getting-bad-csrf-when-updating-topic-via-api-python/199857/2 "2021-08-09T19:28:16Z")

</div>

> [@pedroleaoc](#):
>
> `headers["Authorization"]`

Why are you nesting the headers under this `Authorization` dict key? That is not documented at [Discourse REST API Documentation](https://meta.discourse.org/t/discourse-api-documentation/22706) 🤔

---

<div class="post-metadata">

### Author: ![pedroleaoc](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pedroleaoc/32/230359_2.png) [@pedroleaoc](https://meta.discourse.org/u/pedroleaoc)
#### Post date: [August 9, 2021, 7:53pm UTC](https://meta.discourse.org/t/getting-bad-csrf-when-updating-topic-via-api-python/199857/3 "2021-08-09T19:53:18Z")

</div>

You are right, that’s something the tool I am using to test the API is doing and it works and that’s a problem on itself apparently:

```python
header1 = CaseInsensitiveDict()
header1["Authorization"] = '{"api-key": "longapikey", "api-username": "myusername"}'

header2 = {"api-key": "longapikey", "api-username": "myusername"}

r = requests.get(url, headers= HEADER)

```

When `HEADER` == header1, it works, when == header2, I get:

```json
{"errors":["You are not permitted to view the requested resource. The API username or key is invalid."],"error_type":"invalid_access"}

```

Thanks for your reply btw!