Index: restws.entity.inc
===================================================================
--- restws.entity.inc	(revision 13415)
+++ restws.entity.inc	(working copy)
@@ -167,6 +167,14 @@
 
     try {
       $wrapper = entity_property_values_create_entity($this->entityType, $values);
+
+      // Check that the user is allowed to create this entity. We could not do
+      // it earlier as an entity object is required.
+      if (!$this->access('create', $wrapper)) {
+        watchdog('access denied', check_plain($_GET['q']), NULL, WATCHDOG_WARNING);
+        throw new RestWSException(t('Not authorized to create the entity.'), 403);
+      }
+
       // Get the ID and bundle property names.
       $entity_keys = array_intersect_key($entity_info['entity keys'], array('id' => 1, 'bundle' => 1));
 
Index: restws.module
===================================================================
--- restws.module	(revision 13415)
+++ restws.module	(working copy)
@@ -129,7 +129,7 @@
     // Since there is no access callback for query we need to use view.
     $access_op = $op == 'query' ? 'view' : $op;
 
-    if (user_access('access resource ' . $resource_name) && $resource->access($access_op, $id)) {
+    if (user_access('access resource ' . $resource_name) && ($op == 'create' || $resource->access($access_op, $id))) {
       try {
         $method = $op . 'Resource';
         if ($op == 'create') {