Answers.Body: <p>Yes the civicrm extern/rest.php will merge GET and POST parameters.</p>
  
  <p>Regarding security, while yes it is better to send private data in POST, it's not necessarily that much more secure since POST data can be logged too, just you're right not usually by default. See also <a href="https://security.stackexchange.com/questions/30754/is-there-a-difference-between-get-and-post-for-web-application-security">https://security.stackexchange.com/questions/30754/is-there-a-difference-between-get-and-post-for-web-application-security</a>. For real privacy it would need to be encrypted, and then have some way to decrypt it at the civicrm end.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-04-03T17:41:56.083Z
Answers.LastActivityDate: 2019-04-03T18:05:28.907Z
Answers.LastEditDate: 2019-04-03T18:05:28.907Z
Answers.UserDisplayName: Demerit
Body: <p>I'm unhappy at the prospect of passing sensitive data like contact details as URI parameters for a POST (where they will show in logs, etc.). Is it possible to pass the details in the content body instead? This is standard practice for RESTful APIs and I'm surprised that it is not the standard for civi.</p>
  
Tags: <contacts><api>
Title: passing POST payload in Content Body
ThreadText: # passing POST payload in Content Body
  
  (Asked by: username_0 on 2019-04-03)
  
  I'm unhappy at the prospect of passing sensitive data like contact details as URI parameters for a POST (where they will show in logs, etc.). Is it possible to pass the details in the content body instead? This is standard practice for RESTful APIs and I'm surprised that it is not the standard for civi.
  
  **Tags:** contacts, api
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2019-04-03. Score: 1
  
  Yes the civicrm extern/rest.php will merge GET and POST parameters.
  
  Regarding security, while yes it is better to send private data in POST, it's not necessarily that much more secure since POST data can be logged too, just you're right not usually by default. See also <https://security.stackexchange.com/questions/30754/is-there-a-difference-between-get-and-post-for-web-application-security>. For real privacy it would need to be encrypted, and then have some way to decrypt it at the civicrm end.
  
  
  ---
  
  