mjacobsen4DFM

Thank you. Saves me struggling and hunting.
I’ll have to try creating that endpoint.

Thank you for your troubleshooting advice and tips. I appreciate your time and patience. I will keep digging.

@danielbachhuber Can you offer any advice regarding the false coming from the function above?

It is returning false.
I backtracked it and I believe it is due to https://github.com/WordPress/WordPress/blob/master/wp-includes/class-wp-user.php#L748 function has_cap() returning false when it hits “edit_others_posts”. (It also throws false when it hits “unfiltered_html”, but I am pretty certain that is unrelated).

The confusing thing about the literal interpretation of that capability check is that I am trying to change a post that the authenticated user created.

The error is occurring in /wordpress/wp-includes/rest-api/class-wp-rest-server.php at line 839

if ( ! is_wp_error( $response ) ) {
					// Check permission specified on the route.
					if ( ! empty( $handler['permission_callback'] ) ) {
						$permission = call_user_func( $handler['permission_callback'], $request );

						if ( is_wp_error( $permission ) ) {
							$response = $permission;
						} else if ( false === $permission || null === $permission ) {
							$response = new WP_Error( 'rest_forbidden', __( "You don't have permission to do this." ), array( 'status' => 403 ) );
						}
					}
				}

Oh. I can do that too. I’ll see what I can find.

Tailing tail -f /var/log/httpd/wordpress-access.log doesn’t reveal anything:
192.168.33.1 – admin [29/Dec/2015:22:46:51 +0000] “DELETE /wp-json/wp/v2/posts/1/categories/2 HTTP/1.1” 403 97 “-” “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/537.36”

Tailing tail -f /var/log/httpd/wordpress-error.log has SSL/443 errors, even though I am using basic auth:
[Tue Dec 29 22:53:18 2015] [info] [client 192.168.33.1] Connection to child 9 established (server vccw.dev:443)
[Tue Dec 29 22:53:18 2015] [info] Seeding PRNG with 648 bytes of entropy
[Tue Dec 29 22:53:18 2015] [info] Initial (No.1) HTTPS request received for child 9 (server vccw.dev:443)
[Tue Dec 29 22:53:24 2015] [info] [client 192.168.33.1] (70007)The timeout specified has expired: SSL input filter read failed.
[Tue Dec 29 22:53:24 2015] [info] [client 192.168.33.1] Connection closed to child 9 with standard shutdown (server vccw.dev:443)

(essentially repeats)

I added these to wp-config.php:
define( ‘WP_DEBUG’, true );
// Enable Debug logging to the /wp-content/debug.log file
define( ‘WP_DEBUG_LOG’, true );
// Disable display of errors and warnings
define( ‘WP_DEBUG_DISPLAY’, true);

Which did not generate any logs or messages.

Sorry, I wasn’t clear. I should have mentioned that have a separate instance: https://vccw.dev/wp-json/wp/v2/posts/1/categories/1
Where I still get the error.

I have full access to both instances. I guess I will keep digging and see what I can find.

I am running beta9, and no other plugins, against a plain vanilla WP.

Yes, the theme is Twenty Fifteen.
We are running WordPress 4.5-alpha-36117
This is my GET for https://example.com/mysite/wp-json/wp/v2/posts/577622/terms/category/

[
   {
      "id":15155,
      "count":0,
      "description":"AP:32624",
      "link":"https://example.com/mysite/category/ap-state-online-california/",
      "name":"AP State Online - California",
      "slug":"ap-state-online-california",
      "taxonomy":"category",
      "parent":0,
      "_links":{
         "self":[
            {
               "href":"https://example.com/mysite/wp-json/wp/v2/terms/category/15155"
            }
         ],
         "collection":[
            {
               "href":"https://example.com/mysite/wp-json/wp/v2/terms/category"
            }
         ]
      }
   },
   {
      "id":1,
      "count":0,
      "description":"",
      "link":"https://example.com/mysite/category/uncategorized/",
      "name":"Uncategorized",
      "slug":"uncategorized",
      "taxonomy":"category",
      "parent":0,
      "_links":{
         "self":[
            {
               "href":"https://example.com/mysite/wp-json/wp/v2/terms/category/1"
            }
         ],
         "collection":[
            {
               "href":"https://example.com/mysite/wp-json/wp/v2/terms/category"
            }
         ]
      }
   }
]

Is there any reason a user would have read, write, update permissions, but not delete?

(FWIW, I am only involved on the interface side of things. I don’t know the inner workings of WP)