Symptom/Error
You receive an ACCESS_DENIED error when attempting to create records through the REST API, despite successful authentication and working SELECT or ListTypes operations.
Caption: Example of the error returned when the API rejects the request format.
Root Cause
The underlying Vtiger Webservice API (webservice.php) rejects CREATE operations when they are sent as standard raw JSON bodies. The API interprets these requests as empty or unauthorized, even when the session token is valid.
Solution
To fix this error, you must change your HTTP request format from JSON to form-urlencoded.
Step 1: Change Content-Type Header
Update your POST request header:
From:
Content-Type: application/jsonTo:
Content-Type: application/x-www-form-urlencoded
Step 2: Format Payload as Form Data
Instead of sending a raw JSON body, structure your data as URL-encoded form parameters using these fields:
Key | Value |
|
|
|
|
|
|
|
|
Step 3: Example Payload Format
Your final payload string should look like this:
operation=create&sessionName=[YourSessionToken]&elementType=Contacts&element={"lastname":"Hessler","firstname":"Sam","birthday":"1990-01-01"}
⚠️ Note: Make sure the JSON string in the element parameter is properly URL-encoded!
Step 4: Include All Mandatory Fields
Ensure your record data includes all mandatory fields for the target module.
Caption: Check the module schema to ensure all required fields are included in your 'element' string.
💡 Tip: Missing required fields will result in a MANDATORY_FIELDS_MISSING error rather than an Access Denied error.
When to Contact Support
Contact Dazos Support if:
You continue receiving
ACCESS_DENIEDerrors after switching toform-urlencoded.You are unsure which fields are mandatory for your specific module.
You need a screen share to troubleshoot specific implementation details.