Answers.Body: <p>it's simply based on the name of the action, it has to be starting with get, so get, getsingle and so on are considered readonly and accepts over GET, the rest should be POST.</p>
  
  <p>this being said, not sure using the rest api is the best option, you might want to use the 'normal' ajax backend and the js wrapper part of civi that takes care of calling the api the right way. this assume the same domain for civicrm and the dashboard</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-08-27T11:38:20.457Z
Answers.LastActivityDate: 2015-08-27T14:17:23.033Z
Answers.LastEditDate: 2015-08-27T14:17:23.033Z
Answers.UserDisplayName: Xavier
Body: <p>We're having our custom dashboard that our members log into rewritten by an outsourced agency. It is being done with Angular and will use REST to call the API.</p>
  
  <p>We have a particular custom API call that is giving them the error <em>"SECURITY: All requests that modify the database must be http POST, not GET."</em> This call does not modify the database. It composes and runs a SELECT query using <em>CRM_Core_DAO::executeQuery</em>.</p>
  
  <p>How does the REST security mechanism determine whether a call modifies the database? If it contains handwritten queries will they just have to use a POST request?</p>
  
Tags: <api><rest>
Title: REST error message saying request modifies the database, but it doesn't
ThreadText: # REST error message saying request modifies the database, but it doesn't
  
  (Asked by: username_0 on 2015-08-27)
  
  We're having our custom dashboard that our members log into rewritten by an outsourced agency. It is being done with Angular and will use REST to call the API.
  
  We have a particular custom API call that is giving them the error *"SECURITY: All requests that modify the database must be http POST, not GET."* This call does not modify the database. It composes and runs a SELECT query using *CRM\_Core\_DAO::executeQuery*.
  
  How does the REST security mechanism determine whether a call modifies the database? If it contains handwritten queries will they just have to use a POST request?
  
  **Tags:** api, rest
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2015-08-27. Score: 2 | Accepted answer
  
  it's simply based on the name of the action, it has to be starting with get, so get, getsingle and so on are considered readonly and accepts over GET, the rest should be POST.
  
  this being said, not sure using the rest api is the best option, you might want to use the 'normal' ajax backend and the js wrapper part of civi that takes care of calling the api the right way. this assume the same domain for civicrm and the dashboard
  
  
  ---
  
  