0

I'm an Administrator role user. When I'm using the REST API, if I attempt to call

GET /wp-json/wp/v2/posts?context=edit

I get this error message:

401 Unauthorized : [rest_forbidden_context] Sorry, you are not allowed to edit posts in this post type.

Similar errors are generated for pages queries as well. If I query:

GET /wp-json/wp/v2/users?context=edit

I get a slightly different error message:

401 Unauthorized : [rest_forbidden_context] Sorry, you are not allowed to list users.

I can use the same API endpoints with ?context=view with no problem, but I'd like to be able to view the posts and page content without shortcode expansion, so it's my understanding that I need to query against edit context.

Again, I have the administrator role on the server and can log into the dashboard and edit any post, so I don't think it's a user permission issue with my userid. Any ideas on what might be causing the error?

Some additional details: My server version: 5.5.3 Accessing the API using the wordpress_json library for Python (which under the hoods uses requests' Basic Authentication headers)

2

Clearly your administrator is unable to modify those posts according to the roles and capabilities system.

This is the code that is generating that error in WP_REST_Post_Types_Controller:

    public function get_items_permissions_check( $request ) {
        if ( 'edit' === $request['context'] ) {
            $types = get_post_types( array( 'show_in_rest' => true ), 'objects' );

            foreach ( $types as $type ) {
                if ( current_user_can( $type->cap->edit_posts ) ) {
                    return true;
                }
            }

            return new WP_Error(
                'rest_cannot_view',
                __( 'Sorry, you are not allowed to edit posts in this post type.' ),
                array( 'status' => rest_authorization_required_code() )
            );
        }

        return true;
    }

So the user your python application is interacting as, does not have the edit_posts capability. Assuming it was succesfully authenticating.

What I think has happened here is that you are making unauthenticated requests, under the assumption they are authenticated. Somewhere along the line a mistake was made, perhaps a header is not being applied to your requests, etc.

Either way, what you describe is normal behaviour for an unauthenticated client. I would take a closer look at your python library. For something as simple as basic auth REST API a generic REST API library may be more appropriate and reliable.

Also keep in mind it's not enough to use basic authentication, a plugin needs to be installed and activated at the WP end. WP 5.6 also adds application password support as a more secure alternative

2
  • 1
    Yup, I'm pretty sure that my requests that I thought were authenticated to an Administrator role is in fact occurring remapped to guest. I did not have the BasicAuth Wordpress plugin installed. I've installed the "Application passwords" wordpress plugin (which will likely not be needed once we upgrade to 5.6 when it's officially released), created a new application credential attached to my account and I'm now able to get to the raw content of a post associated with ?context=edit. I'll be accepting your answer as solving my issue. – William McVey Nov 10 '20 at 21:09
  • awesome, glad you got things working :) – Tom J Nowell Nov 11 '20 at 0:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.