# Problem updating user custom\_fields created by a plugin
**URL:** https://meta.discourse.org/t/problem-updating-user-custom-fields-created-by-a-plugin/115344
**Category:** Development
**Created:** [17.Апрель.2019 20:04:46 UTC](https://meta.discourse.org/t/problem-updating-user-custom-fields-created-by-a-plugin/115344 "2019-04-17T20:04:46Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@jezra](https://meta.discourse.org/u/jezra)
#### Post date: [17.Апрель.2019 20:04:46 UTC](https://meta.discourse.org/t/problem-updating-user-custom-fields-created-by-a-plugin/115344/1 "2019-04-17T20:04:46Z")
A bit of backstory: In August of 2018, I was tasked with creating a plugin for Discourse to add a few custom\_fields to the User model. A bit of code hackery later, and a working plugin was created, as well as a ruby script to make a PUT request to update the custom fields via the API. Then I was reassigned to work on other things.
Fast forward to the present, and I am tasked with ensuring the plugin and associated code will work properly. The first thing I did was access the server running dockerized discourse, and update the server and discourse. The app was then rebuilt.
I then ran the test script and it failed to update the custom fields but it did return a 200 status. Checking the production log of discourse shows that the parameters are being received. however the log also states “Can’t verify CSRF token authenticity.”
Any advice to help debug the issue would be greatly appreciated
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [17.Апрель.2019 21:21:08 UTC](https://meta.discourse.org/t/problem-updating-user-custom-fields-created-by-a-plugin/115344/2 "2019-04-17T21:21:08Z")
Are you using a valid API key in the request? CSRF protection is in place for all requests (except GET), so you will need to use an API key to make the the PUT request succeed.
---
### Author:  [@jezra](https://meta.discourse.org/u/jezra)
#### Post date: [17.Апрель.2019 21:25:29 UTC](https://meta.discourse.org/t/problem-updating-user-custom-fields-created-by-a-plugin/115344/3 "2019-04-17T21:25:29Z")
Yes, I am using the API key for user “system”
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [17.Апрель.2019 21:29:22 UTC](https://meta.discourse.org/t/problem-updating-user-custom-fields-created-by-a-plugin/115344/4 "2019-04-17T21:29:22Z")
Can you share how you are making the request? What API endpoint are you calling?
---
### Author:  [@jezra](https://meta.discourse.org/u/jezra)
#### Post date: [17.Апрель.2019 21:42:50 UTC](https://meta.discourse.org/t/problem-updating-user-custom-fields-created-by-a-plugin/115344/5 "2019-04-17T21:42:50Z")
assuming “key” is defined in the script
the end point is: `https://HOSTNAME/users/jezra?api_key=${key}&api_username=system`
and I’m attempting to use curl at the moment
```
curl -X "PUT" $url \
--header "Content-Type: application/json" \
--data '{ "custom_fields": { "my_custom_field_name":"0" }}'
```
---
### Author:  [@jezra](https://meta.discourse.org/u/jezra)
#### Post date: [17.Апрель.2019 22:17:35 UTC](https://meta.discourse.org/t/problem-updating-user-custom-fields-created-by-a-plugin/115344/6 "2019-04-17T22:17:35Z")
is the message about CSRF indicative of a bad api key?
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [17.Апрель.2019 22:35:27 UTC](https://meta.discourse.org/t/problem-updating-user-custom-fields-created-by-a-plugin/115344/7 "2019-04-17T22:35:27Z")
Yes, the CSRF error would suggest a bad API key. The other issue you may be running into is that we added some protection for user custom fields back in September 2018. If you want to be able to edit them from the API, you now need to add something like
```plaintext
register_editable_user_custom_field :my_preference
```
in your plugin. You can find more details on that here: [Add a custom per-user setting in a plugin](https://meta.discourse.org/t/add-a-custom-per-user-setting-in-a-plugin/94048)
---
### Author:  [@jezra](https://meta.discourse.org/u/jezra)
#### Post date: [17.Апрель.2019 23:04:29 UTC](https://meta.discourse.org/t/problem-updating-user-custom-fields-created-by-a-plugin/115344/8 "2019-04-17T23:04:29Z")
My plugin definitely is using the older “register\_custom\_field\_type” method. I will update my plugin, rebuild the app, and then report back.
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [17.Апрель.2019 23:21:36 UTC](https://meta.discourse.org/t/problem-updating-user-custom-fields-created-by-a-plugin/115344/9 "2019-04-17T23:21:36Z")
👍 note that you still want to keep `register_custom_field_type`. `register_editable_user_custom_field` should be added in addition.
Also, this would not explain the CSRF error, but maybe that was a red herring.
---
### Author:  [@jezra](https://meta.discourse.org/u/jezra)
#### Post date: [18.Апрель.2019 21:34:13 UTC](https://meta.discourse.org/t/problem-updating-user-custom-fields-created-by-a-plugin/115344/10 "2019-04-18T21:34:13Z")
After adding `register_editable_user_custom_field` to my plugin, everything is happily working as expected. Thanks!
The production log is still showing the CSRF message when updating via the API; so indeed a red herring.