Error: You need to login with a user that has 'edit_posts' capacity.

To create a new post using create-post endpoint

step 1: Generate Auth Cookie using either JSON API User plugin
https://localhost/api/user/generate_auth_cookie/?nonce=42417d4ff8

or JSON API Auth plugin

https://localhost/api/auth/generate_auth_cookie/?nonce=42417d4ff8

you must get valid nonce first like this for corresponding plugin:

https://localhost/api/get_nonce/?controller=user&method=generate_auth_cookie
or
https://localhost/api/get_nonce/?controller=auth&method=generate_auth_cookie

Once you have got the valid cookie, your user (with create posts rights) will be able to create post like this:

https://localhost/api/posts/create_post/?nonce=94873495&title=Testing REST posting

I just tested it and it works. use latest versions of plugins.

Hello Ali,

This only work if I already logged in to the site, what if I’m not logged in?

In step 2,
https://api_url/?json=auth.generate_auth_cookie&nonce=99bf312d6a&username=myUserName&password=mypassword

I’m getting an object contains:
“cookie”:”myUsername|1422438042|VRFCgnf4j4d9kMZeiIviRhFioylWTfQnsZVjV64cM1l|f6ada3813819b6063011148176847dedb6a037eddac730d592944ae42af189fd”

As tfischer203 mentioned, I should be able to get a cookie and should look something like ‘wordpress_logged_in_68548322…’.

and use https://localhost/api/posts/create_post/?nonce=94873495&title=Testing&$COOKIE_HEADER=cookieValueFromAbove
to create a post

Am I missing something?

Hi everybody,

Ali, I confirm that your process gets success if and only if you try to execute all request from your browser and when you are logged in your site !

But as I mentioned before, my target is to make run a mobile app (front-end) with a web site designed on wordpress (back-end) ! That’s why all requests are written in a unique php script. In this case, it’s not working. doesn’t matter if i’m logged in browser or not.

Any idea ?

——————————————-

Tom, i finally find out my wordpress-logged-in cookie. I’m not sure that it should be written ike this in my script :

$json_url = “https://mydomainname/api/create_post/?nonce=” . $nonce . “&cookie=” . $cookie . “&author=” . $arg1 . “&title=” . $arg3 . “&content=” . $arg4 . “&status=publish”;

// Initializing curl
$ch = curl_init( $json_url );

// Configuring curl options
$options = array(
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => array(‘Content-type: application/json’, ‘COOKIE_HEADER: wordpress_logged_in_09451d069f48070a06dbaa1d519fd5b8’)
);

// Setting curl options
curl_setopt_array( $ch, $options );

// Getting results
$result = curl_exec($ch);

——————————————-

horsehcj, what are you trying to do precisely ?

Hi iScot, I’m trying to create a post from mobile app using javascript

give me a day or so and I will add ‘create_post’ endpoint in json user api plugin to be used with valid cookie.

Thank you Ali. It would be great !

iScot,

Cookies are set as an http header, not as post or get parameters.

In your php sample, it would be something like this:

$json_url = "https://mydomainname/api/create_post/?nonce=" . $nonce . "&author=" . $arg1 . "&title=" . $arg3 . "&content=" . $arg4 . "&status=publish";

// Initializing curl
$ch = curl_init( $json_url );

// Configuring curl options
$options = array(
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => array('Content-type: application/json', 'Cookie: wordpress_logged_in_09451d069f48070a06dbaa1d519fd5b8='.$cookie)
);

// Setting curl options
curl_setopt_array( $ch, $options );

// Getting results
$result = curl_exec($ch);

Just as a general clarification, my original sample uses the command line ‘curl’ command. One of the arguments for that command is ‘-b’ which is used to specify cookies. This seems like a source of confusion.

PS – The steps I indicated will work outside of a browser (ie in a mobile app)

PPS – It seems that there is confusion between the cookie name and the value. The cookie NAME is unique to your wordpress installation and doesn’t change, while the VALUE is different every time you login (and comes from the ‘auth.generate_auth_cookie’ api call). The general format of a cookie header is ‘Cookie: NAME=VALUE’, eg:

Cookie: wordpress_logged_in_09451d069f48070a06dbaa1d519fd5b8=myUsername|1422438042|VRFCgnf4j4d9kMZeiIviRhFioylWTfQnsZVjV64cM1l|f6ada3813819b6063011148176847dedb6a037eddac730d592944ae42af189fd

Ali,

It would also be nice to have an API call to return the cookie name. It seems that this is straightforward enough and can be retrieved from within a wordpress plugin via the variable ‘LOGGED_IN_COOKIE’.

Tom,

You saved my week ! It’s working. Yep, it was a misunderstanding.

I just had to add the “Cookie: NAME=VALUE” to the request for getting nonce too.

But, it would be pretty nice to have a easiest way to make it run by Ali’s API. I have to send 4 requests to make it run.

Ali, I’ll stand for your update asap.

Thanks

iScot,

Glad I could help!

Once you have your cookie, you only need to repeat the last two steps (#4 and 5), you don’t need to generate a new cookie each time. Although you should be prepared to do steps #2 and #3 if the cookie expires, as determined by your wordpress configuration. Providing the cookie in this way should also work for any json-api request that requires the user to be logged in (eg edit_post, delete_post, etc).

Happy wordpress-ing!

-Tom

iScot & Tom,

Sorry to jump in on your discussion here but I think you are facing the same issue I am and it sounds like you got it solved but I’m having trouble putting together the pieces. I’m hoping one of you can help step me through what you wound up doing to make it work.

We will be trying to create posts from another server to our wordpress server. It will be done via php command line without ever having ‘logged in’ to our wordpress server. The cookie creation and validation would need to be done entirely by command line.

I’m able to generate the values needed for the nonce and I can get the long authorization code but when I try to create the post I get the same error you do. The dreaded “You need to login with a user that has ‘edit_posts’ capacity.”

Can one of you possibly step me through each of the calls that need to be made in order to be able to post? We will be using php and curl to make the calls but if you can step me through even with just urls that would be great!

Thanks!
Scott

The five steps I indicated in my original post will work as I described there, they contain ‘curl’ command line examples. My contributions to the following discussion was mostly just clarifying some points of confusion on these five steps.