# JSON vs URL Encoded API Calls - JSON returns BAD CSRF

**URL:** <https://meta.discourse.org/t/json-vs-url-encoded-api-calls-json-returns-bad-csrf/22406>\
**Category:** Feature\
**Created:** [November 22, 2014, 2:20am UTC](https://meta.discourse.org/t/json-vs-url-encoded-api-calls-json-returns-bad-csrf/22406 "2014-11-22T02:20:09Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![sperok](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sperok/32/114977_2.png) [@sperok](https://meta.discourse.org/u/sperok)\
**Post date:** [November 22, 2014, 7:58pm UTC](https://meta.discourse.org/t/json-vs-url-encoded-api-calls-json-returns-bad-csrf/22406/4 "2014-11-22T19:58:58Z")

</div>

I was just prototyping using curl and a REST test tool before starting to code when I found this. It is obviously not a big deal to form encode, but wondering if this may be a generic defect in using the REST APIs with JSON data.

Nice catch on the int vs string @Mittineague, but removing the quotes around the category value does not have an impact on the 403 Forbidden error. If the BAD CSRF problem does get fixed it might then come into play.

Based on the example below, this may have worked at some point in time. It is failing with a fresh upgrade to 1.2.0.beta2.

> [@trident](#):
>
> While not very well documented, it is covered in the wp-discourse code.
> 
> Here’s an example in ruby (from some older stuff I was working on):
> 
> require ‘httparty’  
> @result = HTTParty.post(“\<Discourse URL\>/posts”,  
> :body =\> { :api\_key =\> [‘discourse\_api\_key’], # Global API Key.  
> :api\_username =\> [‘discourse\_api\_username’], # Username to post as.  
> :title =\> [“title”], # Title of topic.  
> :raw =\> “\<contents as string\>”,  
> :category =\> [‘discourse\_api\_category’], #Category to post to.  
> :skip\_validations =\> ‘true’, #Ignores min post length, min title length… etc  
> :auto\_track =\> [‘discourse\_auto\_track’] # User posted as will track the topic.  
> }.to\_json,  
> :headers =\> { ‘Content-Type’ =\> ‘application/json’ } );

---

_[View the full topic](https://meta.discourse.org/t/json-vs-url-encoded-api-calls-json-returns-bad-csrf/22406)._