# New to API, 403 Errors
**URL:** https://meta.discourse.org/t/new-to-api-403-errors/67841
**Category:** Development
**Tags:** rest-api
**Created:** [August 10, 2017, 10:06pm UTC](https://meta.discourse.org/t/new-to-api-403-errors/67841 "2017-08-10T22:06:11Z")
**Posts on this page:** 16
**Page:** 1
### Author:  [@donlucas](https://meta.discourse.org/u/donlucas)
#### Post date: [August 10, 2017, 10:06pm UTC](https://meta.discourse.org/t/new-to-api-403-errors/67841/1 "2017-08-10T22:06:11Z")
Trying to add a member to a group and not finding a solution in the meta forums.
(using python’s requests module)
> `requests.put('https://my.discourse.com/groups/the_group/members.json', data='{"usernames": "newForumUser", "api_key": "theGeneratedAPIKeyForUserNamedanAdmin", "api_username": "anAdmin"}', headers={"Content-Type":"application/json"}`
I get a 403 Forbidden response from the server. The api\_username is a site admin. If I try the command using curl:
> `curl -X POST "https://my.discourse.com/groups/the_group/members.json" -H "Content-Type: multipart/form-data;" -F "api_key=theGeneratedAPIKeyForUserNamedanAdmin" -F "api_username=anAdmin" -F "usernames=newForumUser"`
the html returned is Oops! That page doesn’t exist or is private.
I must be missing something obvious from [http://docs.discourse.org](http://docs.discourse.org)?
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [August 10, 2017, 10:09pm UTC](https://meta.discourse.org/t/new-to-api-403-errors/67841/2 "2017-08-10T22:09:22Z")
I believe that the api\_key and api\_username shoud go as GET params and not as form data.
---
### Author:  [@donlucas](https://meta.discourse.org/u/donlucas)
#### Post date: [August 10, 2017, 10:35pm UTC](https://meta.discourse.org/t/new-to-api-403-errors/67841/3 "2017-08-10T22:35:36Z")
I’ve tried to construct the entire request as a GET:
`https://my.discourse.com/groups/the_group/members.json?api_key=theGeneratedAPIKeyForUseranAdmin&api_username=anAdmin&usernames=newForumUser`
I receive:
`{"errors":["You are not permitted to view the requested resource."],"error_type":"invalid_access"}`
---
### Author:  [@donlucas](https://meta.discourse.org/u/donlucas)
#### Post date: [August 10, 2017, 10:38pm UTC](https://meta.discourse.org/t/new-to-api-403-errors/67841/4 "2017-08-10T22:38:34Z")
Thanks for responding so quickly. If I attempt a purely GET command this is what I am returned:
`{"errors":["You are not permitted to view the requested resource."],"error_type":"invalid_access"}`
The api\_username is an admin user,
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [August 10, 2017, 11:17pm UTC](https://meta.discourse.org/t/new-to-api-403-errors/67841/5 "2017-08-10T23:17:09Z")
You can’t use any admin with any api\_key, are you using a correct username & key pair.
---
### Author:  [@donlucas](https://meta.discourse.org/u/donlucas)
#### Post date: [August 11, 2017, 12:13am UTC](https://meta.discourse.org/t/new-to-api-403-errors/67841/6 "2017-08-11T00:13:03Z")
What user type should I be using to add a member to a group via the API? If I go to /admin/users/list/active I appear to have three types of users: admin users, moderators, unprivileged.
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [August 11, 2017, 1:34am UTC](https://meta.discourse.org/t/new-to-api-403-errors/67841/7 "2017-08-11T01:34:01Z")
> [@Falco](#):
>
> I believe that the api\_key and api\_username shoud go as GET params and not as form data.
If you are making a put/post request they can also go in the body.
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [August 11, 2017, 1:35am UTC](https://meta.discourse.org/t/new-to-api-403-errors/67841/8 "2017-08-11T01:35:47Z")
> [@donlucas](#):
>
> What user type should I be using to add a member to a group via the API?
I would make sure you can get it working as an admin first, but moderators should be able to do that I think.
---
### Author:  [@donlucas](https://meta.discourse.org/u/donlucas)
#### Post date: [August 11, 2017, 4:17am UTC](https://meta.discourse.org/t/new-to-api-403-errors/67841/9 "2017-08-11T04:17:06Z")
I’ve created a few admin users and verified them against the api using a get request for site settings:
> `curl -X GET "https://my.discourse.com/admin/site_settings.json" -F "api_key=theGeneratedAPIKeyForanAdmin" -F "api_username=anAdmin"`
This returns the site settings, However attempting to add a user to a group or even add a topic fail with the same api users.
For instance:
> `curl -X POST "https://my.discourse.com/posts" -H "Content-Type: multipart/form-data;" -F "api_key=theGeneratedAPIKeyForanAdmin" -F "api_username=anAdmin" -F "title=This is an API created topic" -F "topic_id=38" -F "raw=This is the end of the world as we know it, and I feel fine."`
returns:
`{"action":"create_post","errors":["Something has gone wrong. Perhaps this topic was closed or deleted while you were looking at it?"]}`
I’ve left category, target\_usernames, archetype, create\_at out of the curl command as they’re optional (according to the api docs).
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [August 11, 2017, 4:39pm UTC](https://meta.discourse.org/t/new-to-api-403-errors/67841/10 "2017-08-11T16:39:45Z")
Do not specify a topic\_id when creating a topic:
```
curl -X POST "https://my.discourse.com/posts" \
-H "Content-Type: multipart/form-data;" \
-F "api_key=theGeneratedAPIKeyForanAdmin" \
-F "api_username=anAdmin" \
-F "title=This is an API created topic" \
-F "raw=This is the end of the world as we know it, and I feel fine."
```
When creating a group be sure to use the id of the group and not the name of the group and to use a PUT request:
```
curl -X PUT "https://my.discourse.com/groups/group_id/members.json" \
-H "Content-Type: multipart/form-data;" \
-F "api_key=theGeneratedAPIKeyForUserNamedanAdmin" \
-F "api_username=anAdmin" \
-F "usernames=newForumUser"
```
---
### Author:  [@donlucas](https://meta.discourse.org/u/donlucas)
#### Post date: [August 11, 2017, 5:55pm UTC](https://meta.discourse.org/t/new-to-api-403-errors/67841/11 "2017-08-11T17:55:17Z")
> [@blake](#):
>
> do not specify a topic\_id when creating a topic:
Than you for your patience, and Fantastic! I am new to discourse and managing forums, the wording for [Discourse API Docs](http://docs.discourse.org/#tag/Topics%2Fpaths%2F~1posts%2Fpost) topic\_id could be clearer. ‘Required when replying to topic or post.’ or similar.
In regard to group\_id? How is this discoverable? In the GUI, I see the title, short\_name (name) and nothing else. From the api docs, it looks like I need to GET from /admin/groups.json, but that returns no value.
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [August 11, 2017, 6:21pm UTC](https://meta.discourse.org/t/new-to-api-403-errors/67841/12 "2017-08-11T18:21:37Z")
> [@donlucas](#):
>
> it looks like I need to GET from /admin/groups.json, but that returns no value.
We moved this route to `/groups/search.json`
---
### Author:  [@donlucas](https://meta.discourse.org/u/donlucas)
#### Post date: [August 11, 2017, 6:43pm UTC](https://meta.discourse.org/t/new-to-api-403-errors/67841/13 "2017-08-11T18:43:42Z")
Many thanks! I can list the groups out and figure out the id from there.
Thank you both!
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [July 31, 2019, 6:40am UTC](https://meta.discourse.org/t/new-to-api-403-errors/67841/14 "2019-07-31T06:40:36Z")
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [February 1, 2023, 6:48am UTC](https://meta.discourse.org/t/new-to-api-403-errors/67841/15 "2023-02-01T06:48:01Z")
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [February 1, 2023, 8:17am UTC](https://meta.discourse.org/t/new-to-api-403-errors/67841/16 "2023-02-01T08:17:08Z")