Getting 401 (access denied) when trying to use the REST API

admin管理员组

文章数量:1122832

I have a WordPress site in wordpress with the Business plan which enables the REST API. I can test the API by listing blog posts doing a GET request to /wp-json/wp/v2/posts, but POST request to create or modify a post all return a 401. For example:

$ curl --user "flexpointtechunbreach:{application_password}" -X POST -d "title=New Title" /wp-json/wp/v2/posts
{"code":"rest_cannot_create","message":"Sorry, you are not allowed to create posts as this user.","data":{"status":401}}

$ curl --user "flexpointtechunbreach:{application_password}" -X POST -d "title=New Title" /wp-json/wp/v2/posts/8
{"code":"rest_cannot_edit","message":"Sorry, you are not allowed to edit this post.","data":{"status":401}}

flexpointtechunbreach is a user that I created and added to the site with Editor role:

I triple checked the application password was correct, generated a new one just in case and tried that.

That post, id 8, was created by the user flexpointtechunbreach:

I asked customer support at wordpress and they told me everything seems to be set up correctly on the WordPress site.

I'm writing a program that will interact with the API. Over there I tried many different parameters, added app_name, app_id, right or wrong credentials and nothing worked.

Any ideas what else it could be?

I have a WordPress site in wordpress.com with the Business plan which enables the REST API. I can test the API by listing blog posts doing a GET request to /wp-json/wp/v2/posts, but POST request to create or modify a post all return a 401. For example:

$ curl --user "flexpointtechunbreach:{application_password}" -X POST -d "title=New Title" https://testbed.flexpoint.tech/wp-json/wp/v2/posts
{"code":"rest_cannot_create","message":"Sorry, you are not allowed to create posts as this user.","data":{"status":401}}

$ curl --user "flexpointtechunbreach:{application_password}" -X POST -d "title=New Title" https://testbed.flexpoint.tech/wp-json/wp/v2/posts/8
{"code":"rest_cannot_edit","message":"Sorry, you are not allowed to edit this post.","data":{"status":401}}

flexpointtechunbreach is a user that I created and added to the site with Editor role:

I triple checked the application password was correct, generated a new one just in case and tried that.

That post, id 8, was created by the user flexpointtechunbreach:

I asked customer support at wordpress.com and they told me everything seems to be set up correctly on the WordPress site.

I'm writing a program that will interact with the API. Over there I tried many different parameters, added app_name, app_id, right or wrong credentials and nothing worked.

Any ideas what else it could be?

• rest-api

Share Improve this question edited Jul 25, 2022 at 17:32 Pablo Fernandez asked Jul 25, 2022 at 10:33 Pablo FernandezPablo Fernandez 21522 silver badges99 bronze badges 4

• It looks like it's accepting your credentials but failing a permission check for the post specifically. The check is here: github.com/WordPress/WordPress/blob/6.0.1/wp-includes/rest-api/… It just checks if this post type is flagged show_in_rest - is this a custom post type? - and that the user has permission to edit it. – Rup Commented Jul 25, 2022 at 11:53
• For the first one, it looks like you're setting the request author to some other users's ID. Can you set it to that users's ID? relevant code here – Rup Commented Jul 25, 2022 at 11:55
• @Rup: it's not a custom post, I just created it with the same user in the web UI of an otherwise pristine wordpress.com instance. I don't know what show_in_rest is. Anything I should check? – Pablo Fernandez Commented Jul 25, 2022 at 17:25
• @Rup: how do I set the request author? I'm not sure I follow what you mean here. The user is specified in the curl line. I haven't specified a user id anywhere else. – Pablo Fernandez Commented Jul 25, 2022 at 17:26

Add a comment  | 

1 Answer 1

Sorted by: Reset to default 4

I found the problem. WordPress.com has two different application passwords. The one in the 2FA set up page is the wrong one and that's the one I was setting up. To set the right one you need to go to /wp-admin/profile.php. Once I did that, this code started working.

I wrote a blog post with lots of details about all the moving parts in case you want more details: https://pablofernandez.tech/2022/07/31/creating-blog-posts-in-wordpress-com-programatically/

本文标签： Getting 401 (access denied) when trying to use the REST API