To patch a profile entity, I am using an endpoint like...

http://mysite.com/profile/personal_info/29e6cb3a-0951-472d-9b47-27478348021f?_format=json

The body of my request is...

{"data":{"type":"profile--personal_info","id":"29e6cb3a-0951-472d-9b47-27478348021f","attributes":{"phone":"345","first":"Bob","last":"Smith"},"relationships":{"type":{"data":{"type":"profile--personal_info","id":"f3db0295-4e10-4ea1-8708-cbc52c829900"},"links":{"self":"https://mysite.com/profile/personal_info/29e6cb3a-0951-472d-9b47-27478348021f/relationships/type","related":"https://mysite.com/profile/personal_info/29e6cb3a-0951-472d-9b47-27478348021f/type"}}}}}

The response indicates the user does not have some relevant permissions:

{"errors":[{"title":"Forbidden","status":403,"detail":"The current user is not allowed to PATCH the selected resource. The following permissions are required: \u0027update any profile\u0027 OR \u0027update any personal_info profile\u0027.","links":{"info":"http:\/\/www.w3.org\/Protocols\/rfc2616\/rfc2616-sec10.html#sec10.4.4"},"code":0,"id":"\/profile--personal_info\/29e6cb3a-0951-472d-9b47-27478348021f","source":{"pointer":"\/data"}}]}

However, the user does have these permissions. Really, the user should only need the "Update own profile entities" permission for the relevant profile type. The user should not need the permissions indicated in the response. For the sake of testing, though, I have given the user both of the permissions mentioned in the response, but the response is still the same.

Comments

arnoldbird created an issue. See original summary.

arnoldbird’s picture

arnoldbird commented
Issue summary: View changes
arnoldbird’s picture

arnoldbird commented
Status: Active » Closed (works as designed)

My bad. I had a mistake in my URL.