# Getting \["BAD CSRF"\] when updating topic via API \[python\]

**URL:** <https://meta.discourse.org/t/getting-bad-csrf-when-updating-topic-via-api-python/199857>\
**Category:** Development\
**Tags:** rest-api\
**Created:** [August 9, 2021, 7:25pm UTC](https://meta.discourse.org/t/getting-bad-csrf-when-updating-topic-via-api-python/199857 "2021-08-09T19:25:01Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![pedroleaoc](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pedroleaoc/32/230359_2.png) [@pedroleaoc](https://meta.discourse.org/u/pedroleaoc)\
**Post date:** [August 9, 2021, 7:25pm UTC](https://meta.discourse.org/t/getting-bad-csrf-when-updating-topic-via-api-python/199857/1 "2021-08-09T19:25:01Z")

</div>

Hey folks, I am having issues updating a topic. I am able to get the `id` of the first post as shown [here](https://meta.discourse.org/t/updating-topic-body-via-the-api/61220). This is confirmed by running the following:

```python
import requests
from requests.structures import CaseInsensitiveDict

url = "https://my/discourse/instance/posts/{post_id}.json"

headers = CaseInsensitiveDict()
headers["Authorization"] = "{"api-key": "{le_api_key}", "api-username": "{le_username}"}"

resp = requests.get(url, headers=headers)

print(resp.status_code)

```

Which returns a `200` status code and the info I expected about the post.

But when I try:

```python
import requests
from requests.structures import CaseInsensitiveDict

url = "https://my/discourse/instance/posts/{post_id}.json"

headers = CaseInsensitiveDict()
headers["Authorization"] = "{"api-key": "le_api_key", "api-username": "le_username"}"
headers["Content-Type"] = "application/json"

data = """
{
  "post": {
      "raw": "Cool post, but here's an updated to the post's body",
      "edit_reason": "I changed this because I can."
   }
}
"""

resp = requests.put(url, headers=headers, data=data)

print(resp.status_code)

```

I get  
`["BAD CSRF"]`

I am an admin and my key is `global`. Ideally I would like to run this with a less permissive key.  
This post is the first and only in a topic a created via the API.

Thank you so much in advance 🙂

---

_[View the full topic](https://meta.discourse.org/t/getting-bad-csrf-when-updating-topic-via-api-python/199857)._