# JSON vs URL Encoded API Calls - JSON returns BAD CSRF

**URL:** <https://meta.discourse.org/t/json-vs-url-encoded-api-calls-json-returns-bad-csrf/22406>\
**Category:** Feature\
**Created:** [22 Novembro , 2014 02:20 UTC](https://meta.discourse.org/t/json-vs-url-encoded-api-calls-json-returns-bad-csrf/22406 "2014-11-22T02:20:09Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![sperok](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sperok/32/114977_2.png) [@sperok](https://meta.discourse.org/u/sperok)\
**Post date:** [22 Novembro , 2014 02:20 UTC](https://meta.discourse.org/t/json-vs-url-encoded-api-calls-json-returns-bad-csrf/22406/1 "2014-11-22T02:20:09Z")

</div>

Is there possibly a difference in the handling of JSON and formencoded data by the REST API?

If I create a topic it works with Content-Type: application/x-www-formencoded:

```
POST /posts HTTP/1.1
Content-Type: application/x-www-form-urlencoded

api_key=8d3ca248f3eREMOVEDREMOVEDREMOVEDREMOVEDREMOVED868abd4f&api_username=spero&raw=http://www.youtube.com/watch?v=05zrCwLDkVQ&title=What's Good About Compassion&is_warning=false&category=33&archetype=regular

```

but not for JSON, returning 403 Forbidden BAD CSRF which makes me think the api key and username are not being pulled from the JSON data the same way they are from the form encoded above. Or did I screw up something in the JSON? Changing the URL to end in .json has no impact.

```
POST /posts HTTP/1.1
Content-Type: application/json

{ "api_key":"8d3ca248f3eREMOVEDREMOVEDREMOVEDREMOVED868abd4f", "api_username":"spero", "raw":"http://www.youtube.com/watch?v=05zrCwLDkVQ", "title":"What's Good About Compassion", "is_warning":"false", "category":"33", "archetype":"regular" } 

```

My guess is that as soon as I hit enter whatever silly mistake I made jumps off the page.

---

_[View the full topic](https://meta.discourse.org/t/json-vs-url-encoded-api-calls-json-returns-bad-csrf/22406)._