Getting permission denied when trying to update record , REST API

[mohammedsaneenA]

Hi ,

I am Getting permission denied error when trying to use put method on REST API to update record. Any tips on this

[DavidPetty]

Make sure the API user you are using to update the record has update access to the application via a role. And if the application in question has record permission fields the API user needs to be listed in a record permission field that has update access.

[mohammedsaneenA]

Double checked that, yes he/she has all the permissions to update and create record .

A part of the code I used is this

$.ajax({

url: '*url here',

type: 'PUT',

headers: { 'Content-Type': "application/json",'Accept': "application/json"},

dataType: 'json',

contenttype: 'application/json',

         async: false,

data: *data here,

success: function (data, textStatus, xhr) {

console.log(data);

},

error: function (xhr, textStatus, errorThrown) {

console.log('Error in Operation');

}

});

[DavidPetty]

Thanks, you'll need to pass the CSRF token in the ajax call.   Add the following to attribute in your $.ajax

headers: {
     'x-csrf-token': (window.sessionStorage) ? window.sessionStorage.getItem("x-csrf-token") :  parent.parent.ArcherApp.globals['xCsrfToken']
},‍‍‍

[AndyMiscuk1]

Make sure the account that you have in the REST call has the appropriate rights for the operation you are try to perform.

Easy way to test this is to bump the account to sysadmin for a try or two. If it works, you need to refine your permissions on the original account.

Sent with BlackBerry Work (www.blackberry.com)

[mohammedsaneenA]

Hi David,

I tried the same but still permission is being denied

$.ajax({

url: '*url,

type: 'PUT',

headers: {

'x-csrf-token': (window.sessionStorage) ? window.sessionStorage.getItem("x-csrf-token") : parent.parent.ArcherApp.globals['xCsrfToken']

},

dataType: 'json',

contenttype: 'application/json',

         async: false,

data: *data,

success: function (data, textStatus, xhr) {

console.log(data);

},

error: function (xhr, textStatus, errorThrown) {

console.log('Error in Operation');

}

});

[mohammedsaneenA]

Hi Andy,

I have tried the same in sysadmin and still the same occurs .  No luck on that

[AndyMiscuk1]

Have you verified your URL?

Sent with BlackBerry Work (www.blackberry.com)

[DavidPetty]

Can you provide the exact error you're getting back?

Also make sure that the /api folder isn't protected by SSO and that in IIS the folder security is set as anonymous.

[mohammedsaneenA]

Yes Andy , URL is fine.