diff --git a/restws.entity.inc b/restws.entity.inc
index b012e98..e9b2b9a 100644
--- a/restws.entity.inc
+++ b/restws.entity.inc
@@ -74,8 +74,8 @@ interface RestWSResourceControllerInterface {
    *
    * @param string $op
    *   Either 'create', 'view' (= read), 'update' or 'delete'.
-   * @param int|string $id
-   *   The id of the resource.
+   * @param int|string|object $id
+   *   The id (or EntityDrupalWrapper in case of 'create') of the resource.
    *
    * @see entity_access()
    */
@@ -167,6 +167,14 @@ class RestWSEntityResourceController implements RestWSQueryResourceControllerInt
 
     try {
       $wrapper = entity_property_values_create_entity($this->entityType, $values);
+
+      // Check that the user is allowed to create this entity. We could not do
+      // it earlier as an entity object is required.
+      if (!$this->access('create', $wrapper)) {
+        watchdog('access denied', check_plain($_GET['q']), NULL, WATCHDOG_WARNING);
+        throw new RestWSException(t('Not authorized to create the entity.'), 403);
+      }
+
       // Get the ID and bundle property names.
       $entity_keys = array_intersect_key($entity_info['entity keys'], array('id' => 1, 'bundle' => 1));
 
@@ -332,6 +340,11 @@ class RestWSEntityResourceController implements RestWSQueryResourceControllerInt
   }
 
   public function access($op, $id) {
+    // The "create" operation requires an existing entity to check access.
+    // See https://www.drupal.org/node/1780646
+    if ($op == 'create' && gettype($id) != 'EntityDrupalWrapper') {
+      return TRUE;
+    }
     return entity_access($op, $this->entityType, isset($id) ? $this->wrapper($id)->value() : NULL);
   }
 
diff --git a/restws.test b/restws.test
index 06387a1..3f55fc8 100644
--- a/restws.test
+++ b/restws.test
@@ -35,8 +35,7 @@ class RestWSTestCase extends DrupalWebTestCase {
     $this->assertEqual(curl_getinfo($this->curlHandle, CURLINFO_CONTENT_TYPE), 'application/json', 'HTTP content type is correct.');
 
     // Test Create.
-    $account = $this->drupalCreateUser(array('access content',
-      'bypass node access', 'access resource node'));
+    $account = $this->drupalCreateUser(array('access content', 'access resource node'));
     $title = $this->randomName(8);
     $new_node = array(
       'body'      => array(LANGUAGE_NONE => array(array())),
@@ -77,7 +76,7 @@ class RestWSTestCase extends DrupalWebTestCase {
    */
   public function testBadRequests() {
     // Assure that nodes without types won't be created.
-    $account = $this->drupalCreateUser(array('access content', 'bypass node access', 'access resource node', 'administer users'));
+    $account = $this->drupalCreateUser(array('access content', 'access resource node', 'administer users'));
     $title = $this->randomName(8);
     $new_node = array(
       'body'  => array(LANGUAGE_NONE => array(array())),
@@ -101,7 +100,7 @@ class RestWSTestCase extends DrupalWebTestCase {
     $this->checkPermissions(array(), TRUE);
 
     // Assure that users can't create nodes with unauthorized input formats.
-    $unprivileged_account = $this->drupalCreateUser(array('bypass node access', 'access resource node'));
+    $unprivileged_account = $this->drupalCreateUser(array('access resource node'));
     $title = $this->randomName(8);
     $new_node = array(
       'body'  => array(
@@ -119,7 +118,7 @@ class RestWSTestCase extends DrupalWebTestCase {
     $this->assertEqual(count($node), 0, "Node with unauthorized input format wasn't created");
 
     // Check that the format is allowed if the permission is present.
-    $privileged_account = $this->drupalCreateUser(array('bypass node access', 'access resource node', 'use text format php_code'));
+    $privileged_account = $this->drupalCreateUser(array('access resource node', 'use text format php_code'));
     $this->httpRequest('node', 'POST', $privileged_account, $json);
     $this->assertResponse('201');
 
@@ -184,7 +183,7 @@ class RestWSTestCase extends DrupalWebTestCase {
 
     // A user without the "administer users" permission should not be able to
     // create a node with the access protected field.
-    $unprivileged_account = $this->drupalCreateUser(array('bypass node access', 'access resource node'));
+    $unprivileged_account = $this->drupalCreateUser(array('access resource node'));
     $title = $this->randomName(8);
     $new_node = array(
       'title' => $title,
@@ -198,7 +197,7 @@ class RestWSTestCase extends DrupalWebTestCase {
     $this->assertEqual(count($nodes), 0, "Node with access protected field wasn't created");
 
     // Test again with the additional permission, this should work now.
-    $privileged_account = $this->drupalCreateUser(array('bypass node access', 'access resource node', 'administer users'));
+    $privileged_account = $this->drupalCreateUser(array('access resource node', 'administer users'));
     $this->httpRequest('node', 'POST', $privileged_account, $json);
     $this->assertResponse('201');
     $node = node_load(1, NULL, TRUE);
@@ -226,7 +225,7 @@ class RestWSTestCase extends DrupalWebTestCase {
    */
   public function testResourceArray() {
     $account = $this->drupalCreateUser(array(
-      'access content', 'bypass node access', 'access resource node',
+      'access content', 'access resource node',
     ));
     $this->drupalLogin($account);
     $this->createTerm("foo");
@@ -287,8 +286,7 @@ class RestWSTestCase extends DrupalWebTestCase {
    */
   public function testXmlFormatter() {
     // Test Read.
-    $account = $this->drupalCreateUser(array('access content',
-      'bypass node access', 'access resource node')
+    $account = $this->drupalCreateUser(array('access content', 'access resource node')
     );
     $this->drupalLogin($account);
     $title = $this->randomName(8);
@@ -317,8 +315,7 @@ class RestWSTestCase extends DrupalWebTestCase {
     $this->assertResponse('404', 'HTTP response code is correct.');
 
     // Update a node with an unknown property.
-    $account = $this->drupalCreateUser(array('access content',
-      'bypass node access', 'access resource node')
+    $account = $this->drupalCreateUser(array('access content', 'access resource node')
     );
     $node = $this->drupalCreateNode();
     $property_name = $this->randomName(8);
@@ -381,8 +378,7 @@ class RestWSTestCase extends DrupalWebTestCase {
    * Tests resource querying.
    */
   public function testQuerying() {
-    $account = $this->drupalCreateUser(array('access content',
-        'bypass node access', 'access resource node')
+    $account = $this->drupalCreateUser(array('access content', 'access resource node')
     );
     $this->drupalLogin($account);
 
@@ -531,8 +527,7 @@ class RestWSTestCase extends DrupalWebTestCase {
    * Test menu path resource setting.
    */
   public function testMenuPath() {
-    $account = $this->drupalCreateUser(array('access content',
-        'bypass node access', 'access resource node')
+    $account = $this->drupalCreateUser(array('access content', 'access resource node')
     );
     $this->drupalLogin($account);