src/Controller/EntityResource.php                          |  2 +-
 src/Exception/EntityAccessDeniedHttpException.php          |  7 ++++---
 .../EntityAccessDeniedHttpExceptionNormalizer.php          | 14 ++++++++------
 src/Normalizer/JsonApiDocumentTopLevelNormalizer.php       |  4 +++-
 4 files changed, 16 insertions(+), 11 deletions(-)

diff --git a/src/Controller/EntityResource.php b/src/Controller/EntityResource.php
index 294c03f..bed9b51 100644
--- a/src/Controller/EntityResource.php
+++ b/src/Controller/EntityResource.php
@@ -194,7 +194,7 @@ class EntityResource {
     $entity_access = $entity->access('create', NULL, TRUE);
 
     if (!$entity_access->isAllowed()) {
-      throw new EntityAccessDeniedHttpException($entity, $entity_access, '/data', 'The current user is not allowed to POST the selected resource.');
+      throw new EntityAccessDeniedHttpException(NULL, $entity_access, '/data', 'The current user is not allowed to POST the selected resource.');
     }
     $this->validate($entity);
 
diff --git a/src/Exception/EntityAccessDeniedHttpException.php b/src/Exception/EntityAccessDeniedHttpException.php
index 46d85d1..5d66d3c 100644
--- a/src/Exception/EntityAccessDeniedHttpException.php
+++ b/src/Exception/EntityAccessDeniedHttpException.php
@@ -33,8 +33,8 @@ class EntityAccessDeniedHttpException extends HttpException {
   /**
    * EntityAccessDeniedHttpException constructor.
    *
-   * @param \Drupal\Core\Entity\EntityInterface $entity
-   *   The entity.
+   * @param \Drupal\Core\Entity\EntityInterface|NULL $entity
+   *   The entity, or NULL when an entity is being created.
    * @param \Drupal\Core\Access\AccessResultInterface $entity_access
    *   The access result.
    * @param string $pointer
@@ -48,7 +48,8 @@ class EntityAccessDeniedHttpException extends HttpException {
    * @param int $code
    *   The code.
    */
-  public function __construct(EntityInterface $entity, AccessResultInterface $entity_access, $pointer, $messsage = 'The current user is not allowed to GET the selected resource.', \Exception $previous = NULL, array $headers = [], $code = 0) {
+  public function __construct($entity, AccessResultInterface $entity_access, $pointer, $messsage = 'The current user is not allowed to GET the selected resource.', \Exception $previous = NULL, array $headers = [], $code = 0) {
+    assert(is_null($entity) || $entity instanceof EntityInterface);
     parent::__construct(403, $messsage, $previous, $headers, $code);
 
     $error = [
diff --git a/src/Normalizer/EntityAccessDeniedHttpExceptionNormalizer.php b/src/Normalizer/EntityAccessDeniedHttpExceptionNormalizer.php
index de42beb..e9077dc 100644
--- a/src/Normalizer/EntityAccessDeniedHttpExceptionNormalizer.php
+++ b/src/Normalizer/EntityAccessDeniedHttpExceptionNormalizer.php
@@ -36,12 +36,14 @@ class EntityAccessDeniedHttpExceptionNormalizer extends HttpExceptionNormalizer
       $pointer = $error['pointer'];
       $reason = $error['reason'];
 
-      $errors[0]['id'] = sprintf(
-        '/%s--%s/%s',
-        $entity->getEntityTypeId(),
-        $entity->bundle(),
-        $entity->uuid()
-      );
+      if (isset($entity)) {
+        $errors[0]['id'] = sprintf(
+          '/%s--%s/%s',
+          $entity->getEntityTypeId(),
+          $entity->bundle(),
+          $entity->uuid()
+        );
+      }
       $errors[0]['source']['pointer'] = $pointer;
 
       if ($reason) {
diff --git a/src/Normalizer/JsonApiDocumentTopLevelNormalizer.php b/src/Normalizer/JsonApiDocumentTopLevelNormalizer.php
index d701206..e34c085 100644
--- a/src/Normalizer/JsonApiDocumentTopLevelNormalizer.php
+++ b/src/Normalizer/JsonApiDocumentTopLevelNormalizer.php
@@ -5,10 +5,12 @@ namespace Drupal\jsonapi\Normalizer;
 use Drupal\Component\Plugin\Exception\PluginNotFoundException;
 use Drupal\Component\Utility\NestedArray;
 use Drupal\Component\Uuid\Uuid;
+use Drupal\Core\Access\AccessResult;
 use Drupal\Core\Entity\EntityTypeManagerInterface;
 use Drupal\Core\Field\EntityReferenceFieldItemListInterface;
 use Drupal\jsonapi\Context\CurrentContext;
 use Drupal\jsonapi\Context\FieldResolver;
+use Drupal\jsonapi\Exception\EntityAccessDeniedHttpException;
 use Drupal\jsonapi\Normalizer\Value\JsonApiDocumentTopLevelNormalizerValue;
 use Drupal\jsonapi\Resource\EntityCollection;
 use Drupal\jsonapi\LinkManager\LinkManager;
@@ -319,7 +321,7 @@ class JsonApiDocumentTopLevelNormalizer extends NormalizerBase implements Denorm
     if (isset($document['data']['id']) && !Uuid::isValid($document['data']['id'])) {
       // This should be a 422 response, but the JSON API specification dictates
       // a 403 Forbidden response. We follow the specification.
-      throw new AccessDeniedHttpException('IDs should be properly generated and formatted UUIDs as described in RFC 4122.');
+      throw new EntityAccessDeniedHttpException(NULL, AccessResult::forbidden(), '/data/id', 'IDs should be properly generated and formatted UUIDs as described in RFC 4122.');
     }
   }