# API problem with curl

**URL:** <https://farmos.discourse.group/t/api-problem-with-curl/317>\
**Category:** Using farmOS\
**Created:** [April 28, 2020, 8:10am UTC](https://farmos.discourse.group/t/api-problem-with-curl/317 "2020-04-28T08:10:52Z")\
**Posts on this page:** 17\
**Page:** 1

<div class="post-metadata">

**Author:** ![bonushenricus](https://yyz2.discourse-cdn.com/free1/user_avatar/farmos.discourse.group/bonushenricus/32/139_2.png) [@bonushenricus](https://farmos.discourse.group/u/bonushenricus)\
**Post date:** [April 28, 2020, 8:10am UTC](https://farmos.discourse.group/t/api-problem-with-curl/317/1 "2020-04-28T08:10:52Z")

</div>

Hello  
i am trying to use  
I used the recommended method

> curl --cookie-jar farmOS-cookie.txt -d ‘name=[USER]&pass=[PASS]&form\_id=user\_login’ [URL]/user/login  
> TOKEN=“$(curl --cookie farmOS-cookie.txt [URL]/restws/session/token)”

result:

> % Total % Received % Xferd Average Dload Speed Upload  
> Time Total Time Spent Time Left Current Speed  
> 100 43 100 43 0 0 38 0 0:00:01 0:00:01 --:–:–  
> 38

then I try

> curl --cookie farmOS-cookie.txt -H ‘Content-Type: application/json’ -d ‘{“name”: “Test observation via REST”, “type”: “farm\_observation”, “timestamp”: “1526584271”}’ “X-CSRF-Token: ${TOKEN}”

result:

> curl: (3) Illegal port number

where am i wrong?

What I would like to do is use curl inside gthumb to load observations from the photos, taking the GPS of the photo as geometry, and then speed up the loading of my observations.

Thank you

---

<div class="post-metadata">

**Author:** ![mstenta](https://yyz2.discourse-cdn.com/free1/user_avatar/farmos.discourse.group/mstenta/32/4_2.png) [@mstenta](https://farmos.discourse.group/u/mstenta)\
**Post date:** [April 28, 2020, 12:26pm UTC](https://farmos.discourse.group/t/api-problem-with-curl/317/2 "2020-04-28T12:26:13Z")

</div>

> [@bonushenricus](#):
>
> then I try
> 
> > curl --cookie farmOS-cookie.txt -H ‘Content-Type: application/json’ -d ‘{“name”: “Test observation via REST”, “type”: “farm\_observation”, “timestamp”: “1526584271”}’ “X-CSRF-Token: ${TOKEN}”

This command is incomplete. It is missing `-X POST` and the URL to post to (assuming you are trying to create a new log).

See the example here: [API | farmOS](https://farmos.org/development/api/#creating-logs)

Hope that helps!

---

<div class="post-metadata">

**Author:** ![bonushenricus](https://yyz2.discourse-cdn.com/free1/user_avatar/farmos.discourse.group/bonushenricus/32/139_2.png) [@bonushenricus](https://farmos.discourse.group/u/bonushenricus)\
**Post date:** [April 28, 2020, 1:30pm UTC](https://farmos.discourse.group/t/api-problem-with-curl/317/3 "2020-04-28T13:30:23Z")

</div>

I try now with

> curl -X POST --cookie farmOS-cookie.txt -H “X-CSRF-Token: ${TOKEN}” -d ‘{“name”: “Test observation via REST”, “type”: “farm\_observation”, “timestamp”: “1526584271”}’ [Farmier | farmOS Hosting, Support, and Development](https://bonushenricus.farmos.net/farm/logs)

and also with

> curl -X POST --cookie farmOS-cookie.txt -H ‘Content-Type: application/json’ -d ‘{“name”: “Test observation via REST”, “type”: “farm\_observation”, “timestamp”: “1526584271”}’ [Farmier | farmOS Hosting, Support, and Development](https://bonushenricus.farmos.net/farm/logs)

Nothing!  
I don’t understand!  
I have the result terminal save in my computer  
Maybe this kind of problem is to post in github? I always get confused

---

<div class="post-metadata">

**Author:** ![mstenta](https://yyz2.discourse-cdn.com/free1/user_avatar/farmos.discourse.group/mstenta/32/4_2.png) [@mstenta](https://farmos.discourse.group/u/mstenta)\
**Post date:** [April 28, 2020, 1:45pm UTC](https://farmos.discourse.group/t/api-problem-with-curl/317/4 "2020-04-28T13:45:27Z")

</div>

Is your farmOS installed in a `farm` subdirectory in the webroot?

If not, then your URL is wrong. For creating logs, it needs to be `[URL]/log`. (Not `/farm/logs`).

---

<div class="post-metadata">

**Author:** ![bonushenricus](https://yyz2.discourse-cdn.com/free1/user_avatar/farmos.discourse.group/bonushenricus/32/139_2.png) [@bonushenricus](https://farmos.discourse.group/u/bonushenricus)\
**Post date:** [April 28, 2020, 1:51pm UTC](https://farmos.discourse.group/t/api-problem-with-curl/317/5 "2020-04-28T13:51:17Z")

</div>

Hello and thanks!  
I don’t know. It is in the farmier cloud.  
For the first with -H …TOKEN  
the result with /log ([https://bonushenricus.farmos.net/log](https://bonushenricus.farmos.net/log)) is  
“The page request “/log” doesn’t found”  
In the case of the try with -H … .json and without TOKEN  
the result is “403 Access Denied: CSRF validation failed”

---

<div class="post-metadata">

**Author:** ![mstenta](https://yyz2.discourse-cdn.com/free1/user_avatar/farmos.discourse.group/mstenta/32/4_2.png) [@mstenta](https://farmos.discourse.group/u/mstenta)\
**Post date:** [April 28, 2020, 2:58pm UTC](https://farmos.discourse.group/t/api-problem-with-curl/317/6 "2020-04-28T14:58:50Z")

</div>

You need to POST with both the cookie and the CSRF token to /log. I think that if you do a GET request to /log it will say 404 not found.

Your command should look like this exactly (I broke it up over multiple lines to make it easier to read too):

```auto
curl -X POST \
  --cookie farmOS-cookie.txt \
  -H "X-CSRF-Token: ${TOKEN}" \
  -H 'Content-Type: application/json' \
  -d '{"name": "Test observation via REST", "type": "farm_observation", "timestamp": "1526584271"}' \
  https://bonushenricus.farmos.net/log

```

That is assuming that your `farmOS-cookie.txt` file is in the same directory (from earlier), and that `echo $TOKEN` prints a valid token. If not, then perform the authentication steps again before running the command above (just replace `[USER]` and `[PASS]`):

```auto
curl --cookie-jar farmOS-cookie.txt -d 'name=[USER]&pass=[PASS]&form_id=user_login' https://bonushenricus.farmos.net/user/login
TOKEN="$(curl --cookie farmOS-cookie.txt https://bonushenricus.farmos.net/restws/session/token)"

```

---

<div class="post-metadata">

**Author:** ![bonushenricus](https://yyz2.discourse-cdn.com/free1/user_avatar/farmos.discourse.group/bonushenricus/32/139_2.png) [@bonushenricus](https://farmos.discourse.group/u/bonushenricus)\
**Post date:** [April 28, 2020, 5:51pm UTC](https://farmos.discourse.group/t/api-problem-with-curl/317/7 "2020-04-28T17:51:08Z")

</div>

I feel a little ignorant  
With

> curl --cookie-jar farmOS-cookie.txt \   
> -d ‘name=enricogabrielli76.peragr@gmail.com&pass=\*\*\*\*\*\*\*\*\*\*\*&form\_id=user\_login’ \   
> [Farmier | farmOS Hosting, Support, and Development](https://bonushenricus.farmos.net/user/login)  
> TOKEN=“$(curl --cookie farmOS-cookie.txt \ [Farmier | farmOS Hosting, Support, and Development](https://bonushenricus.farmos.net/restws/session/token))”  
> curl -X POST --cookie farmOS-cookie.txt -H “X-CSRF-Token: ${TOKEN}” \   
> -H ‘Content-Type: application/json’ \   
> -d ‘{“name”: “Test observation via REST”, “type”: “farm\_observation”, “timestamp”: “1588093459”,}’ \   
> [Farmier | farmOS Hosting, Support, and Development](https://bonushenricus.farmos.net/log)

(I used a timestamp for today)  
there seem to be no errors, the cookie.txt is created  
but no trace of the log on the web

---

<div class="post-metadata">

**Author:** ![mstenta](https://yyz2.discourse-cdn.com/free1/user_avatar/farmos.discourse.group/mstenta/32/4_2.png) [@mstenta](https://farmos.discourse.group/u/mstenta)\
**Post date:** [April 28, 2020, 7:02pm UTC](https://farmos.discourse.group/t/api-problem-with-curl/317/8 "2020-04-28T19:02:15Z")

</div>

Hmm, and are you seeing any output in the terminal after the POST? Normally it will return JSON with the ID of the new log that was created, when successful.

---

<div class="post-metadata">

**Author:** ![mstenta](https://yyz2.discourse-cdn.com/free1/user_avatar/farmos.discourse.group/mstenta/32/4_2.png) [@mstenta](https://farmos.discourse.group/u/mstenta)\
**Post date:** [April 28, 2020, 7:11pm UTC](https://farmos.discourse.group/t/api-problem-with-curl/317/9 "2020-04-28T19:11:01Z")

</div>

Don’t worry! Running curl commands can be very finicky. You have to get it perfect in order for it to work. 🙂

Some thoughts:

- That chunk of code you pasted should actually be three separate commands (maybe they got munged together and you tried to run them together?)
- I also notice that your single and double quotes are formatted (as opening and closing quotes), rather than the plain quote characters from the keyboard. That may have been a result of copying and pasting from this forum. Just make sure that they are plain (not “left” or “right” quotes) in the commands you run.
- You were also missing a `$` in front of `{TOKEN}`.

I fixed all of those in the commands below. Try running these one after another:

1: Login and get cookie

```auto
curl --cookie-jar farmOS-cookie.txt -d 'name=enricogabrielli76.peragr@gmail.com&pass= *********** &form_id=user_login' https://bonushenricus.farmos.net/user/login

```

2: Get the CSRF Token

```auto
TOKEN="$(curl --cookie farmOS-cookie.txt https://bonushenricus.farmos.net/restws/session/token)"

```

3: Create the log

```auto
curl -X POST --cookie farmOS-cookie.txt -H "X-CSRF-Token: ${TOKEN}" -H 'Content-Type: application/json' -d '{"name": "Test observation via REST", "type": "farm_observation", "timestamp": "1588093459"}' https://bonushenricus.farmos.net/log

```

---

<div class="post-metadata">

**Author:** ![bonushenricus](https://yyz2.discourse-cdn.com/free1/user_avatar/farmos.discourse.group/bonushenricus/32/139_2.png) [@bonushenricus](https://farmos.discourse.group/u/bonushenricus)\
**Post date:** [April 29, 2020, 4:18am UTC](https://farmos.discourse.group/t/api-problem-with-curl/317/10 "2020-04-29T04:18:21Z")

</div>

Thanks but it doesn’t run  
The result is:

> 403 Access Denied: CSRF validation failed

The token here [Farmier | farmOS Hosting, Support, and Development](https://bonushenricus.farmos.net/restws/session/token) is always the same: is it correct?  
The farmOS-cookie.txt has the last line:

> #HttpOnly\_.bonushenricus.farmos.net TRUE / FALSE 1590133289 SESSXXXXXXXXXXXXXXXXXXXXX ` **********-****************************** -*`

Is it correct?

I try with farmOS-cookie.txt modified removing the # and changing the timestamp expire. I command new TOKEN. The TOKEN in [Farmier | farmOS Hosting, Support, and Development](https://bonushenricus.farmos.net/restws/session/token) change.  
The result of curl -X POST is:

> 403 Forbidden

P.S.: yes double quotes are formatted wrong from a result of copying and pasting to this forum.

---

<div class="post-metadata">

**Author:** ![Symbioquine](https://yyz2.discourse-cdn.com/free1/user_avatar/farmos.discourse.group/symbioquine/32/284_2.png) [@Symbioquine](https://farmos.discourse.group/u/Symbioquine)\
**Post date:** [April 29, 2020, 1:46pm UTC](https://farmos.discourse.group/t/api-problem-with-curl/317/11 "2020-04-29T13:46:08Z")

</div>

@bonushenricus Make sure to invalidate that session ASAP - ideally before posting it to a public forum - since it could be trivially used by a malicious third party to gain access to your farmOS instance. See [https://drupal.stackexchange.com/questions/239396/how-to-secure-session-cookies](https://drupal.stackexchange.com/questions/239396/how-to-secure-session-cookies)

---

<div class="post-metadata">

**Author:** ![mstenta](https://yyz2.discourse-cdn.com/free1/user_avatar/farmos.discourse.group/mstenta/32/4_2.png) [@mstenta](https://farmos.discourse.group/u/mstenta)\
**Post date:** [April 29, 2020, 1:58pm UTC](https://farmos.discourse.group/t/api-problem-with-curl/317/12 "2020-04-29T13:58:32Z")

</div>

Thank you @Symbioquine - you beat me to it. 🙂

Definitely need to be careful posting those details anywhere public @bonushenricus - as they would allow anyone access to your farmOS. The easiest way to invalidate them is to go to your farmOS and log out then log back in. That should reset any sessions for your user account.

---

<div class="post-metadata">

**Author:** ![bonushenricus](https://yyz2.discourse-cdn.com/free1/user_avatar/farmos.discourse.group/bonushenricus/32/139_2.png) [@bonushenricus](https://farmos.discourse.group/u/bonushenricus)\
**Post date:** [April 29, 2020, 2:27pm UTC](https://farmos.discourse.group/t/api-problem-with-curl/317/13 "2020-04-29T14:27:07Z")

</div>

I’m sorry  
I believed that not writing the session and my password was enough  
however I disconnected and reconnected.

---

<div class="post-metadata">

**Author:** ![mstenta](https://yyz2.discourse-cdn.com/free1/user_avatar/farmos.discourse.group/mstenta/32/4_2.png) [@mstenta](https://farmos.discourse.group/u/mstenta)\
**Post date:** [April 29, 2020, 3:48pm UTC](https://farmos.discourse.group/t/api-problem-with-curl/317/14 "2020-04-29T15:48:51Z")

</div>

@bonushenricus - Getting back to your original issue…

I just noticed another missing `$` in the `TOKEN=` command I provided above. Sorry about that. I have edited my comment to include it.

Give those three commands another try. Fingers crossed that it works for you this time! Make sure that they are copied EXACTLY to your command prompt.

---

<div class="post-metadata">

**Author:** ![bonushenricus](https://yyz2.discourse-cdn.com/free1/user_avatar/farmos.discourse.group/bonushenricus/32/139_2.png) [@bonushenricus](https://farmos.discourse.group/u/bonushenricus)\
**Post date:** [April 29, 2020, 3:53pm UTC](https://farmos.discourse.group/t/api-problem-with-curl/317/15 "2020-04-29T15:53:43Z")

</div>

Yes!!!  
You are fantastic!!!

---

<div class="post-metadata">

**Author:** ![bonushenricus](https://yyz2.discourse-cdn.com/free1/user_avatar/farmos.discourse.group/bonushenricus/32/139_2.png) [@bonushenricus](https://farmos.discourse.group/u/bonushenricus)\
**Post date:** [April 29, 2020, 9:20pm UTC](https://farmos.discourse.group/t/api-problem-with-curl/317/16 "2020-04-29T21:20:05Z")

</div>

When I go to the countryside for my field technician job I often make visual observations with photos with my Olympus TG-3 with GPS: excellent photos.  
When I get home I download them with GThumb, I select them, I make them smaller.  
Often on the field I don’t have time to write many notes, also I don’t have a smartphone, the tablet is old and uncomfortable to carry around.  
Here I was born the idea of creating observations on FarmOS from the photos.  
This is my solution:  
I create a little script to create a .json file from a photo with command

> exiftool -p json.fmt -d %s file.jpeg \> out.json

The json.fmt:

> {  
> “name”: “$description#”,  
> “notes”:{“value”:“\u003Cp\u003E$filename#\u003C/p\u003E\n”,“format”:“farm\_format”},  
> “type”: “farm\_observation”,  
> “timestamp”: “$datetimeoriginal”,  
> “geofield”:[{“geom”:“POINT($gpslongitude# $gpslatitude#)”}]  
> }

For the file image it’s difficult to realise base64 I believe.  
But I can upload the photo later manually. The important thing is to upload an observation that has the exact point of the photo and the exact date and time of the shot, and the description I gave to the photo.

when it comes to photos of insects I load the photos into the INATURALIST: in this way I have help in identifying.  
The next step could be to use the INaturalist API to create an observation in FarmOS with the position, description and in the notes the link to the observation on INaturalist.

I’m so happy!

---

<div class="post-metadata">

**Author:** ![paul121](https://avatars.discourse-cdn.com/v4/letter/p/54ee81/32.png) [@paul121](https://farmos.discourse.group/u/paul121)\
**Post date:** [May 3, 2020, 8:17pm UTC](https://farmos.discourse.group/t/api-problem-with-curl/317/17 "2020-05-03T20:17:42Z")

</div>

@bonushenricus great idea!! That’s a clever way of creating the JSON file with image metadata.

You inspired me to create a Python script to do this, too 😃

This creates an observation log with the image coordinates and timestamp. Also uploads the image

> <https://gist.github.com/paul121/408dacd4f87a6967257d2bc303148d6e>