Setting ?context=edit results in rest_forbidden_context, even for an Administrator user

Question

I'm an Administrator role user. When I'm using the REST API, if I attempt to call

GET /wp-json/wp/v2/posts?context=edit

I get this error message:

401 Unauthorized : [rest_forbidden_context] Sorry, you are not allowed to edit posts in this post type.

Similar errors are generated for pages queries as well. If I query:

GET /wp-json/wp/v2/users?context=edit

I get a slightly different error message:

401 Unauthorized : [rest_forbidden_context] Sorry, you are not allowed to list users.

I can use the same API endpoints with ?context=view with no problem, but I'd like to be able to view the posts and page content without shortcode expansion, so it's my understanding that I need to query against edit context.

Again, I have the administrator role on the server and can log into the dashboard and edit any post, so I don't think it's a user permission issue with my userid. Any ideas on what might be causing the error?

Some additional details: My server version: 5.5.3 Accessing the API using the wordpress_json library for Python (which under the hoods uses requests' Basic Authentication headers)

Answer 1

Clearly your administrator is unable to modify those posts according to the roles and capabilities system.

This is the code that is generating that error in WP_REST_Post_Types_Controller:

    public function get_items_permissions_check( $request ) {
        if ( 'edit' === $request['context'] ) {
            $types = get_post_types( array( 'show_in_rest' => true ), 'objects' );

            foreach ( $types as $type ) {
                if ( current_user_can( $type->cap->edit_posts ) ) {
                    return true;
                }
            }

            return new WP_Error(
                'rest_cannot_view',
                __( 'Sorry, you are not allowed to edit posts in this post type.' ),
                array( 'status' => rest_authorization_required_code() )
            );
        }

        return true;
    }

So the user your python application is interacting as, does not have the edit_posts capability. Assuming it was succesfully authenticating.

What I think has happened here is that you are making unauthenticated requests, under the assumption they are authenticated. Somewhere along the line a mistake was made, perhaps a header is not being applied to your requests, etc.

Either way, what you describe is normal behaviour for an unauthenticated client. I would take a closer look at your python library. For something as simple as basic auth REST API a generic REST API library may be more appropriate and reliable.

Also keep in mind it's not enough to use basic authentication, a plugin needs to be installed and activated at the WP end. WP 5.6 also adds application password support as a more secure alternative