Thanks for your help. It was very usefule.

I should add - the reason I was getting a 302 redirect response on logging in is because there was a trigger on the site to redirect on login. Unfortunately, that trigger also fires for login over web-service.
To get round it I had to install the Rules module and make a Rule to trigger a redirect for web login, but not for web-service login.
When this is in, you'll get a 200 response for successful login, and the response will look something like:

<?xml version="1.0" encoding="utf-8"?>
<result>
    <sessid>bdd7f59556ba31f3f1717f628d13ef03</sessid>
    <session_name>SESSc926dcbf8f9ff16891c1969cc8f6ce18</session_name>
    <user>
        <uid>113</uid>
        <name>theusername</name>
        <pass>encryptedpassword</pass>
        <mail>usersemail</mail>
        <mode>0</mode>
        <sort>0</sort>
        <threshold>0</threshold>
        <theme></theme>
        <signature></signature>
        <signature_format>0</signature_format>
        <created>1283767512</created>
        <access>1296568054</access>
        <login>1296651720</login>
        <status>1</status>
        <timezone/>
        <language></language>
        <picture></picture>
        <init>initstuff</init>
        <data>somedata</data>
        <roles is_array="true">
            <item>authenticated user</item>
        </roles>
        <profile_name>username</profile_name>
        <profile_user_status>status text</profile_user_status>
        <profile_read_aboutus>1</profile_read_aboutus>
    </user>
</result>

Which should be persisted somewhere locally.

What I don't understand still is where does the 'session_name' value exist in this way of calling system/connect. You can not register a user without the full cookie and when posting to system/connect you get returned just the sessID (as the above example shows). The header to send with user/create is something like 'Cookie: SESS5913ad7ed2adf92cab1103dad2f5596c=213d28535c6972e16430a4e1e03ce7ea' See: http://drupal.org/node/910598

I am a lost about this.

I try to post to http://localhost/services_upgrade/test_endpoint/system/connect, but I always get the error:
HTTP/1.0 404 Not found: Could not find the controller.
What's the error?

Thank you polarbear128 your comments helped.
I was able to POST the initial session ID request from Poster by setting the Content type to "application/json".

I would be very happy if you could post your code to create a user. I can currently only do GET requests using Drupal 7 and services. And actually I'm trying to connect without the Drupal API.

thanks.

/*
 * :Author: | Eswara Rajesh Pinapala : mailme@beingrajesh.com.
 */

/**
 * Description of DrupalREST
 * This class enables communication with Drupal REST API
 * @author epinapala
 */
class drupalRest {

    var $username;
    var $password;
    var $session;
    var $endpoint;
    var $debug;

    function __construct($endpoint, $username, $password, $debug) {
        $this->username = $username;
        $this->password = $password;
        if ((substr($endpoint, -1) != "/")) {
            //no trailing slash! Add one!
            $endpoint .= "/";
        }
        $this->endpoint = $endpoint;
        $this->debug = $debug;
    }

    function login() {
        $ch = curl_init($this->endpoint . 'user/login/');
        $post_data = array(
            'username' => $this->username,
            'password' => $this->password,
        );
        $post = json_encode($post_data);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_HEADER, false);
        curl_setopt($ch, CURLOPT_POST, true);
        curl_setopt($ch, CURLOPT_POSTFIELDS, $post);
        curl_setopt($ch, CURLOPT_HTTPHEADER, array(
            "Accept: application/json",
            "Content-type: application/json"
        ));
        $response = json_decode(curl_exec($ch));
        curl_close($ch);
        //Save Session information to be sent as cookie with future calls
        $this->session = $response->session_name . '=' . $response->sessid;
    }

    // Retrieve a node from a node id
    function retrieveNode($nid) {
        //Cast node id as integer
        $nid = (int) $nid;
        $ch = curl_init($this->endpoint . 'node/' . $nid . '/');
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_HEADER, TRUE);
        curl_setopt($ch, CURLINFO_HEADER_OUT, TRUE);
        curl_setopt($ch, CURLOPT_HTTPHEADER, array(
            "Accept: application/json",
            "Cookie: $this->session"
        ));
        $result = $this->_handleResponse($ch);

        curl_close($ch);

        return $result;
    }

    function createNode($node_json) {
        $ch = curl_init($this->endpoint . 'node/');
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
        curl_setopt($ch, CURLOPT_HEADER, TRUE); // Ask to not return Header
        curl_setopt($ch, CURLOPT_POST, TRUE);
        curl_setopt($ch, CURLOPT_POSTFIELDS, $node_json);
        curl_setopt($ch, CURLOPT_HTTPHEADER, array('Accept: application/json', 'Content-Type: application/json'));
        curl_setopt($ch, CURLOPT_COOKIE, "$this->session"); // use the previously saved session
        curl_setopt($ch, CURLOPT_FAILONERROR, TRUE);
        $result = $this->_handleResponse($ch);
        curl_close($ch);
        return $result;
    }

    // Private Helper Functions
    private function _handleResponse($ch) {
        $response = curl_exec($ch);
        $info = curl_getinfo($ch);

        //break apart header & body
        $header = substr($response, 0, $info['header_size']);
        $body = substr($response, $info['header_size']);

        $result = new stdClass();

        if ($info['http_code'] != '200') {
            $header_arrray = explode("\n", $header);
            $result->ErrorCode = $info['http_code'];
            $result->ErrorText = $header_arrray['0'];
        } else {
            $result->ErrorCode = NULL;
            $decodedBody = json_decode($body);
            $result = (object) array_merge((array) $result, (array) $decodedBody);
        }

        if ($this->debug) {
            $result->header = $header;
            $result->body = $body;
        }

        return $result;
    }

}

Here is an example how to create a new user with D7 using a REST server that is also hosted in D7.

    $url = 'http://localhost/servicename/users/';//this is the user module, I renamed it to users (mind the extra "s" at the end)

    $data = '&username=username&password=password';//replace the username and password with an existing account available on the site you call the service on
    $options = array(
      'headers' => array(
        'Accept' => 'application/json',
      ),
      'method' => 'POST',
      'data' => $data
    );
    $headers = array("content-type"=>"application/x-www-form-urlencoded");

    //here we call the login
    $login = drupal_http_request(
      $url.'login',
      $options
    );
    
    $arSes=explode(';',$login->headers["set-cookie"]);//get the session info we need.

    $account = array(
      'name' => 'test_user',
      'pass' => 'xyzzy',
      'mail' => 'test_user@xyzzy.com',
    );

    $query = http_build_query($account=array('account'=>$account), '', '&');
    //if we got code 200, the login was a succes, we can procede to create a user account
    if($login->code==200){

        $options['headers']['Cookie'] = $arSes[0];//set the active session
        $options['data'] = $query;
        $options['method'] = 'POST';

        $response = drupal_http_request(
          $url,
          $options
        );
    }

    //create a dump from all the data that we got back
    var_dump($query,$login,$response);

Here is an example that works for Drupal 6

key/value pairs should be

Name ->

This is about the minimum data you need to create a node

I am trying to do this in D7 and I need all the nodes that have a certain tid in them, I do have multiple tid's per node. I am not sure if that will prevent it or not.

I have a custom retrieve resource configured which always returns a 401 error.
path/node and path/user can be retrieved fine so I really don't understand path/mytest is throwing a permission denied. access callback is TRUE.

$resource['mytest'] = array(
          'retrieve' => array(
              'help' => 'Retrieves Data',
              'callback' => '_myapi_data',
              'access callback' => TRUE,
              'args' => array(
                  array('name' => 'parameters',
                      'type' => 'string',
                      'description' => 'This is a test resource for services',
                      'source' => array('path' => '0'), 
                      'optional' => FALSE,
                  ),
              ),
          ),
      );

Looking at various examples I can't see why this wouldn't work, but no doubt is something obvious I'm missing.

I don't know this for sure, however normally you assign roles on user creation or modification.

This means when you post using poster in firefox(or any other browser) you get something like this:
&account[name]=test_user&account[mail]=test@example.com&account[pass]=example&account[roles][1]=authenticated user&account[roles][2]=other role&account[roles][5]=the fith role

So you got the basic: &account[roles] then followed by the role ID (the unique id that is definend in the table), followed by the name of the role(however this can be anything I think.)

This should set your roles when creating a user account, if it doesn't work it could be a permission issue.

It is necessary to use the services module
https://www.drupal.org/project/Services
in which to set the endpoint called by your code.
I implemented this module that makes a call to another site where the resources are

/*
* Implementation of hook_menu().
*
* @return array
*/ 
function rest_target_menu() {
$items['admin/settings/rest-target'] = array(
  'type' => MENU_NORMAL_ITEM,
  'title' => 'Rest target',
  'description' => 'Settings for session expiry',
  'page callback' => 'drupal_get_form',
  'page arguments' => array('rest_target_settings_form'),
  'access arguments' => array('administer site configuration'),
  );
return $items;
}

function rest_target_settings_form() {
  $form['#submit'][] = 'rest_target_settings_form_submit';	
  $form['login_link'] = array(
    '#type' => 'item',
    '#markup' => '<div>This enables communication with Drupal REST API</div>', 
  );
  
  $form['submit'] = array(
    '#type'  => 'submit',
    '#value' => t('Submit'),
  ); 
  return $form;
}

function rest_target_settings_form_submit() {
  drupal_set_message(t('The form has been submitted.'));
  
  $account = array(
    'username' => 'Target Admin',
    'password' => '654321'
  );
  // Requires a configured user resource for the services module on the target system
  $url = 'http://classified.synergize.co/api/user/';
  $options = array(
    'headers' => array(
      'Accept' => 'application/json',
    ),
    'method' => 'POST',
    'data' => http_build_query($account, '', '&'),
  );

  // login to target
  $login = drupal_http_request(
    $url . 'login',
    $options
  );

  // get the session info
  $sesh = explode(';', $login->headers["set-cookie"]);

  // To get CSRF, use the session from the login just authenticated
  $options2 = array(
    'headers' => array(
      'Content-Type' => 'application/x-www-form-urlencoded',
      'Cookie' => $sesh[0]
    ),
    'method' => 'POST',
  );
  $csrf_response = drupal_http_request($url . 'token', $options2);
  $csrf = json_decode($csrf_response->data);

  drupal_set_message('<pre>csrf: '. print_r($csrf, TRUE) .'</pre>');

  // TODO: admin form
  $newuser = array(
    'name' => 'test_vendor',
    'pass' => '654321',
    'mail' => 'example@company.com',
  );

  $query = http_build_query($account=array('account'=>$newuser), '', '&');

  drupal_set_message('<pre>login: '. print_r($login, TRUE) .'</pre>');
  
  if ($login->code == 200) {
    // Now, set the correct hearers for the session; specifically, the X-CSRF-Token
    $options['headers']['Cookie'] = $sesh[0];
    $options['headers']['Content-Type'] = 'application/x-www-form-urlencoded';
    $options['headers']['X-CSRF-Token'] = $csrf->token;

    $options['data'] = $query;
    $options['method'] = 'POST';

    // Time to create a new user
    $response = drupal_http_request(
      $url . 'register',
      $options
    );
  }
  else {
    // TODO: Error? what could go wrong?
    $response = 'blargh';
  }

  // the data that we get back
  drupal_set_message('<pre>response: '. print_r($response, TRUE) .'</pre>');
}	

Well done.