XF 2.1 registering and managing users from outside

[yar]

(1) Looking for a right way to register/create new user on XenForo from outside script that is run on the same webserver (and even on same domain) as forums but from different folder. There is API endpoint for that (POST /users) but I don't see related "scope" checkbox when creating API Key (should use "All scopes"?).

(2) Also want to evaluate alternative solution that would require bootstrapping XF's framework in my PHP script and triggering needed methods directly but struggle to find working examples / tutorials - would appreciate if you point me to some, I am sure you have them. --- what I need is to be able to a) create new user and b) authenticate him, same domain hosting and c) change their email and/or password.

Thanks!

 

[yar]

was trying to make "POST /community/api/users" request with following parameters: "username", "password" and "email" without success - getting error "You do not have permission to view this page or perform this action." even though I was doing that request using "Super user key" with "All scopes" checked.

 

[Cupara]

When using the API to do POST, you need an API Key for it to be successful. What I mean is you need to make sure your sending the API Key prior to the POST action.

 

[yar]

I am sending API Key as part of the request in header as "XF-Api-Key"-

> POST /community/api/users HTTP/1.1
> Host: myhost.localhost
> Content-Type: application/x-www-form-urlencoded
> XF-Api-Key: 45ktcBLAHBLAHBLAHKEYGOESHEREb2lthe
> Content-Length: 52

| username=lorem&password=ipsum&email=some%40gmail.com

* upload completely sent off: 52 out of 52 bytes

< HTTP/1.1 403 Forbidden
< Date: Fri, 07 Jun 2019 20:37:00 GMT
< Server: Apache/2.4.25 (Debian)
< X-Powered-By: PHP/7.2.19
< XF-Latest-Api-Version: 1
< XF-Used-Api-Version: 1
< XF-Request-User: 0
< Expires: Thu, 19 Nov 1981 08:52:00 GMT
< Cache-Control: private, no-cache, max-age=0
< Content-Length: 211
< Content-Type: application/json; charset=utf-8

 

[slw]

Try adding api_bypass_permissions=1 request parameter and see if that gets you through. It helped me get past the same error.

 

[lucky-angel]

Try adding api_bypass_permissions=1 request parameter and see if that gets you through. It helped me get past the same error.

This was still broken and adding a this fixed it.. and yes the user post permission was active.