Unable to create Paragraph with format json

Yes, previously we didn't have any check there.

We could add a custom permission and check that in \Drupal\paragraphs\ParagraphAccessControlHandler::checkCreateAccess(), you can also do the same in a custom hook_ENTITY_TYPE_create_access() implementation.

> which is assigned a role that already has the create paragraph permission.

That's the point. There is no such permission. Paragraphs access without any additional modules like the type permissions (which should actually work if you use that), *solely* work through the parent field access check in the UI. But if you create them through REST, then there is no such check and anyone can create paragraphs.

That is why the security update made this change as a stop-gap until a better solution can be found.

Doesn't work for me

function seed_trade_core_paragraph_create_access(\Drupal\Core\Session\AccountInterface $account, array $context, $entity_bundle) {

  // No opinion.
  return \Drupal\Core\Access\AccessResult::allowed();
}

{
    "message": "You are not authorized to create this paragraph entity of bundle potential_seeds."
}

Can someone help me?

I need only enable Paragraphs Type Permissions module

This is actually an issue which should be addressed - by displaying correct error message or something of that sort. The #8 comment points it out, that Paragraphs Type Permissions module actually allows the paragraph to be created by using REST API.

Without it enabled I got error 403 and "message": {} response and was completely lost. I didn't do any extra configuration for Paragraphs Type Permissions though - enabling just worked.

I'm enabled Text: Create content, Video: Create content In Paragraphs Type Permissions for my REST user role, but still getting the error 403 and {"message":""} in response while trying to add some paragraphs to node created earlier.

here JSON for the Text Paragraph:

   {
        "field_text": [
            {
                "value": text,
                "format": "full_html",
                "processed": text
            }
        ],
        "parent_id": [
            {
                "value": str(parent_id)
            }
        ],
        "parent_type": [
            {
                "value": "node"
            }
        ],
        "parent_field_name": [
            {
                "value": "field_paragraphs"
            }
        ],
        "type": [
            {
                "target_id": "text"
            }
        ],
        "_links": {
            "type": {
                "href": base_url + REST_TYPE_PARAGRAPH_TEXT
            }
        }
    }

Here for the Video paragraph:

{
        "field_video": {
            "value": "video:" + str(video_id)
        },
        "parent_id": [
            {
                "value": str(parent_id)
            }
        ],
        "parent_type": [
            {
                "value": "node"
            }
        ],
        "parent_field_name": [
            {
                "value": "field_paragraphs"
            }
        ],
        "type": [
            {
                "target_id": "video"
            }
        ],
        "_links": {
            "type": {
                "href": base_url + REST_TYPE_PARAGRAPH_VIDEO
            }
        }
    }

What permission am I missing here?

Check on permission Paragraphs Type Permissions -> Bypass Paragraphs type content access control was missing here.

There was also a problem with the JSON request payload of the video paragraph, here the correct version:

    {
        "field_video": [
            {
                "target_id": video_id
            }
        ],
        "parent_id": [
            {
                "value": parent_id
            }
        ],
        "parent_type": [
            {
                "value": "node"
            }
        ],
        "parent_field_name": [
            {
                "value": "field_paragraphs"
            }
        ],
        "type": [
            {
                "target_id": "video"
            }
        ],
        "_links": {
            "type": {
                "href": base_url + REST_TYPE_PARAGRAPH_VIDEO
            },
            base_url +  REST_RELATION_PARAGRAPH_VIDEO_FIELD_VIDEO: [
                {
                    "href": base_url + "/media/%d/edit" % video_id + FORMAT_HAL_JSON,
                    "lang": "en"
                }
            ]
        }
    }

And a correct/working version of the text paragraph JSON payload:

    {
        "field_text": [
            {
                "value": text,
                #"format": "full_html" - getting error "full_html" not recognized
            }
        ],
        "parent_id": [
            {
                "value": str(parent_id)
            }
        ],
        "parent_type": [
            {
                "value": "node"
            }
        ],
        "parent_field_name": [
            {
                "value": "field_paragraphs"
            }
        ],
        "type": [
            {
                "target_id": "text"
            }
        ],
        "_links": {
            "type": {
                "href": base_url + REST_TYPE_PARAGRAPH_TEXT
            }
        }
    }

After fixing those issues and passing a successful (status: 200) update (patch) to the node with next JSON, I sill cant see those paragraphs in the node:
Code in python:

    payload = {
        "field_paragraphs": [],
        "_links": {
            "type": {
                "href": oauth.base_url + REST_TYPE_NODE_ARTICLE
            },
            oauth.base_url + REST_RELATION_NODE_ARTICLE_FIELD_PARAGRAPHS: []
        }
    }
    for paragraph_id in paragraph_ids:
        payload["field_paragraphs"].append(
            [
                {
                    "target_id":  paragraph_id
                }
            ]
        )
        payload["_links"][oauth.base_url + REST_RELATION_NODE_ARTICLE_FIELD_PARAGRAPHS].append(
            {
                "href":  oauth.base_url + "/entity/paragraph/%d" % paragraph_id + FORMAT_HAL_JSON
            }
        )

What I'm missing here?

Also reporting that I'm getting a 403 with {"message":""} when trying to create a paragraph via REST. I have the Paragraphs Type Permissions enabled and my user is in the Bypass role. Here's my request:

curl -v -i -u xxx:yyy -d "@node_1009_paragraph.json" -H "Content-type: application/json" "http://localhost:8000/entity/paragraph?_format=json"

and here's my paragraph JSON:

{
  "type": [
    {
      "target_id": "my_test_paragraph"
    }
  ],
  "status": [
    {
      "value": true
    }
  ],
  "parent_id": [
    {
      "value": "1009"
    }
  ],
  "parent_type": [
    {
      "value": "node"
    }
  ],
  "parent_field_name": [
    {
      "value": "field_my_test_paragraph_field"
    }
  ],
  "field_first_field_test": [
    {
      "value": "Value for first field created via REST."
    }
  ]
}

I'm running Drupal 9.4.0-dev and Paragraphs 8.x-1.14.

There is quite similar issue - https://www.drupal.org/project/paragraphs/issues/3047678 so I've added it as related. Patches are the same but not sure which issue could be labeled as "duplicated".