diff --git a/restws.entity.inc b/restws.entity.inc
index b012e98..c2e3a0c 100644
--- a/restws.entity.inc
+++ b/restws.entity.inc
@@ -74,8 +74,8 @@ interface RestWSResourceControllerInterface {
    *
    * @param string $op
    *   Either 'create', 'view' (= read), 'update' or 'delete'.
-   * @param int|string $id
-   *   The id of the resource.
+   * @param int|string|object $id
+   *   The id (or EntityDrupalWrapper in case of 'create') of the resource.
    *
    * @see entity_access()
    */
@@ -167,8 +167,16 @@ class RestWSEntityResourceController implements RestWSQueryResourceControllerInt
 
     try {
       $wrapper = entity_property_values_create_entity($this->entityType, $values);
-      // Get the ID and bundle property names.
-      $entity_keys = array_intersect_key($entity_info['entity keys'], array('id' => 1, 'bundle' => 1));
+
+      // Check that the user is allowed to create this entity. We could not do
+      // it earlier as an entity object is required.
+      if (!$this->access('create', $wrapper)) {
+        watchdog('access denied', check_plain($_GET['q']), NULL, WATCHDOG_WARNING);
+        throw new RestWSException(t('Not authorized to create the entity.'), 403);
+      }
+
+      // Get the entity keys properties.
+      $entity_keys = array_merge($entity_info['entity keys'], ['status' => 'status']);
 
       foreach (array_keys($values) as $name) {
         // Don't check access on entity keys for new entities. Otherwise,
@@ -198,11 +206,10 @@ class RestWSEntityResourceController implements RestWSQueryResourceControllerInt
   public function update($id, array $values) {
     $wrapper = $this->wrapper($id);
     $entity_info = $wrapper->entityInfo();
-    // Get the ID and bundle property names.
-    $entity_keys = array_intersect_key($entity_info['entity keys'], array('id' => 1, 'bundle' => 1));
+
     try {
       foreach ($values as $name => $value) {
-        if (in_array($name, $entity_keys)) {
+        if (in_array($name, array("id", "bundle"))) {
           // We don't allow changing the entity ID or bundle.
           if ($wrapper->{$name}->value() != $value) {
             throw new RestWSException('Unable to change ' . $name, 422);
@@ -210,7 +217,8 @@ class RestWSEntityResourceController implements RestWSQueryResourceControllerInt
         }
         else {
           $wrapper->{$name}->set($value);
-          if (!$this->checkPropertyAccess($wrapper, $name, $wrapper->{$name})) {
+          if (!$wrapper->entityAccess('update')
+            && !$this->checkPropertyAccess($wrapper, $name, $wrapper->{$name})) {
             throw new RestWSException(t('Not authorized to set property @p', array('@p' => $name)), 403);
           }
         }
@@ -332,6 +340,11 @@ class RestWSEntityResourceController implements RestWSQueryResourceControllerInt
   }
 
   public function access($op, $id) {
+    // The "create" operation requires an existing entity to check access.
+    // See https://www.drupal.org/node/1780646
+    if ($op == 'create' && empty($id)) {
+      return TRUE;
+    }
     return entity_access($op, $this->entityType, isset($id) ? $this->wrapper($id)->value() : NULL);
   }
 
diff --git a/restws.test b/restws.test
index 06387a1..7cd08ba 100644
--- a/restws.test
+++ b/restws.test
@@ -35,8 +35,7 @@ class RestWSTestCase extends DrupalWebTestCase {
     $this->assertEqual(curl_getinfo($this->curlHandle, CURLINFO_CONTENT_TYPE), 'application/json', 'HTTP content type is correct.');
 
     // Test Create.
-    $account = $this->drupalCreateUser(array('access content',
-      'bypass node access', 'access resource node'));
+    $account = $this->drupalCreateUser(array('create page content', 'access resource node'));
     $title = $this->randomName(8);
     $new_node = array(
       'body'      => array(LANGUAGE_NONE => array(array())),
@@ -54,6 +53,7 @@ class RestWSTestCase extends DrupalWebTestCase {
     $this->assertEqual(curl_getinfo($this->curlHandle, CURLINFO_CONTENT_TYPE), 'application/json', 'HTTP content type is correct.');
 
     // Test Update.
+    $account = $this->drupalCreateUser(array('edit any page content', 'access resource node'));
     $new_title = $this->randomName(8);
     $json = drupal_json_encode(array('title' => $new_title));
     $this->httpRequest('node/' . $node->nid, 'PUT', $account, $json);
@@ -64,6 +64,7 @@ class RestWSTestCase extends DrupalWebTestCase {
     $this->assertEqual(curl_getinfo($this->curlHandle, CURLINFO_CONTENT_TYPE), 'application/json', 'HTTP content type is correct.');
 
     // Test delete.
+    $account = $this->drupalCreateUser(array('delete any page content', 'access resource node'));
     $this->httpRequest('node/' . $node->nid, 'DELETE', $account);
     // Clear the static cache, otherwise we won't see the update.
     $node = node_load($node->nid, NULL, TRUE);
@@ -77,7 +78,7 @@ class RestWSTestCase extends DrupalWebTestCase {
    */
   public function testBadRequests() {
     // Assure that nodes without types won't be created.
-    $account = $this->drupalCreateUser(array('access content', 'bypass node access', 'access resource node', 'administer users'));
+    $account = $this->drupalCreateUser(array('access content', 'access resource node', 'administer users'));
     $title = $this->randomName(8);
     $new_node = array(
       'body'  => array(LANGUAGE_NONE => array(array())),
@@ -101,7 +102,7 @@ class RestWSTestCase extends DrupalWebTestCase {
     $this->checkPermissions(array(), TRUE);
 
     // Assure that users can't create nodes with unauthorized input formats.
-    $unprivileged_account = $this->drupalCreateUser(array('bypass node access', 'access resource node'));
+    $unprivileged_account = $this->drupalCreateUser(array('edit any page content', 'create page content', 'access resource node'));
     $title = $this->randomName(8);
     $new_node = array(
       'body'  => array(
@@ -119,7 +120,7 @@ class RestWSTestCase extends DrupalWebTestCase {
     $this->assertEqual(count($node), 0, "Node with unauthorized input format wasn't created");
 
     // Check that the format is allowed if the permission is present.
-    $privileged_account = $this->drupalCreateUser(array('bypass node access', 'access resource node', 'use text format php_code'));
+    $privileged_account = $this->drupalCreateUser(array('edit any page content', 'create page content', 'access resource node', 'use text format php_code'));
     $this->httpRequest('node', 'POST', $privileged_account, $json);
     $this->assertResponse('201');
 
@@ -184,7 +185,7 @@ class RestWSTestCase extends DrupalWebTestCase {
 
     // A user without the "administer users" permission should not be able to
     // create a node with the access protected field.
-    $unprivileged_account = $this->drupalCreateUser(array('bypass node access', 'access resource node'));
+    $unprivileged_account = $this->drupalCreateUser(array('edit any page content', 'create page content', 'access resource node'));
     $title = $this->randomName(8);
     $new_node = array(
       'title' => $title,
@@ -198,7 +199,7 @@ class RestWSTestCase extends DrupalWebTestCase {
     $this->assertEqual(count($nodes), 0, "Node with access protected field wasn't created");
 
     // Test again with the additional permission, this should work now.
-    $privileged_account = $this->drupalCreateUser(array('bypass node access', 'access resource node', 'administer users'));
+    $privileged_account = $this->drupalCreateUser(array('edit any page content', 'create page content', 'access resource node', 'administer users'));
     $this->httpRequest('node', 'POST', $privileged_account, $json);
     $this->assertResponse('201');
     $node = node_load(1, NULL, TRUE);
@@ -226,7 +227,7 @@ class RestWSTestCase extends DrupalWebTestCase {
    */
   public function testResourceArray() {
     $account = $this->drupalCreateUser(array(
-      'access content', 'bypass node access', 'access resource node',
+      'edit any article content', 'create article content', 'access resource node', 'administer users','bypass node access'
     ));
     $this->drupalLogin($account);
     $this->createTerm("foo");
@@ -276,6 +277,7 @@ class RestWSTestCase extends DrupalWebTestCase {
     // Test XML create.
     $result = $this->httpRequest('node', 'POST', $account, $xml, 'xml');
     $xml_element = simplexml_load_string($result);
+    $this->assertTrue(is_object($xml_element), 'simplexml_load_string(' . print_r((array)$result,1) . ') returns valid object.');
     $nid = $xml_element->attributes()->id;
     $node = node_load((int) $nid, NULL, TRUE);
     $this->assertEqual($node->field_tags[LANGUAGE_NONE][0]['tid'], 1, 'Taxonomy term 1 was correctly added.');
@@ -287,9 +289,7 @@ class RestWSTestCase extends DrupalWebTestCase {
    */
   public function testXmlFormatter() {
     // Test Read.
-    $account = $this->drupalCreateUser(array('access content',
-      'bypass node access', 'access resource node')
-    );
+    $account = $this->drupalCreateUser(array('edit any page content', 'access content', 'access resource node'));
     $this->drupalLogin($account);
     $title = $this->randomName(8);
     $node = $this->drupalCreateNode(array('title' => $title));
@@ -317,9 +317,7 @@ class RestWSTestCase extends DrupalWebTestCase {
     $this->assertResponse('404', 'HTTP response code is correct.');
 
     // Update a node with an unknown property.
-    $account = $this->drupalCreateUser(array('access content',
-      'bypass node access', 'access resource node')
-    );
+    $account = $this->drupalCreateUser(array('edit any page content', 'create page content', 'access resource node'));
     $node = $this->drupalCreateNode();
     $property_name = $this->randomName(8);
     $json = drupal_json_encode(array($property_name => $property_name));
@@ -341,6 +339,18 @@ class RestWSTestCase extends DrupalWebTestCase {
     $this->assertEqual($result, "406 Not Acceptable: Unknown data property $property_name.", 'Response body is correct');
     $this->assertResponse('406', 'HTTP response code is correct.');
 
+    // Create a node with missing permission.
+    $account = $this->drupalCreateUser(array('access content', 'access resource node'));
+    $new_node = array(
+      'body'      => array(LANGUAGE_NONE => array(array())),
+      'title'     => $this->randomName(8),
+      'type'      => 'page',
+      'author'    => $account->uid,
+    );
+    $json = drupal_json_encode($new_node);
+    $result = $this->httpRequest('node', 'POST', $account, $json);
+    $this->assertEqual($result, '403 Forbidden: Not authorized to create the entity.', 'Response body is correct');
+    $this->assertResponse(403);
 
     // Simulate a CSRF attack without the required token.
     $new_title = 'HACKED!';
@@ -381,8 +391,7 @@ class RestWSTestCase extends DrupalWebTestCase {
    * Tests resource querying.
    */
   public function testQuerying() {
-    $account = $this->drupalCreateUser(array('access content',
-        'bypass node access', 'access resource node')
+    $account = $this->drupalCreateUser(array('access content', 'access resource node')
     );
     $this->drupalLogin($account);
 
@@ -531,8 +540,7 @@ class RestWSTestCase extends DrupalWebTestCase {
    * Test menu path resource setting.
    */
   public function testMenuPath() {
-    $account = $this->drupalCreateUser(array('access content',
-        'bypass node access', 'access resource node')
+    $account = $this->drupalCreateUser(array('access content', 'access resource node')
     );
     $this->drupalLogin($account);