Answers.Body: <p>@pfigel in chat.civicrm.org responded that this is possibly a problem with encoding. This works for him:</p>
  
  <pre><code>curl -X POST 'http://civicrm.example.com/sites/all/modules/civicrm/extern/rest.php' -H 'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' --data 'api_key=hunter2&amp;key=hunter2&amp;entity=Contact&amp;action=create&amp;json=%7B%22contact_type%22%3A%22Individual%22%2C%22first_name%22%3A%22John%22%2C%22last_name%22%3A%22Doe%22%2C%22api.Address.create%22%3A%7B%22location_type_id%22%3A%22Home%22%2C%22street_address%22%3A%22Main+Street%22%7D%7D'
  </code></pre>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-04-11T19:37:03.953Z
Answers.LastActivityDate: 2019-04-11T19:37:03.953Z
Answers.UserDisplayName: Joe Murray
Answers.Body: <p>CiviCRM allows you to send api params in POST by encrypting the params in json. Here is an example on how you can build api params used in REST call</p>
  
  <pre><code>http://www.domain.org/sites/all/modules/civicrm/extern/rest.php?entity=Contact&amp;action=create&amp;api_key=userkey&amp;key=sitekey&amp;json={"contact_type":"Individual","first_name":"test","last_name":"test","api.Address.create":{"location_type_id":"Home","street_address":"123 somewhere st"}}
  </code></pre>
  
  <p>You can use api explorer to build your params.</p>
  
  <p><a href="https://i.sstatic.net/3vbyz.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/3vbyz.png" alt="enter image description here"></a></p>
  
  <p>Thanks</p>
  
  <p>Pradeep</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-04-08T23:10:59.967Z
Answers.Text: Quick question: When you say "encrypt" do you mean "encode"? It's not actually encrypted, right?
Answers.UserDisplayName: Demerit
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-04-08T23:11:40.297Z
Answers.Text: I meant json encoded
Answers.UserDisplayName: Pradeep Nayak
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-04-09T17:18:24.600Z
Answers.Text: you've missed the point of my question. I know you can chain the parameters via the URI. This is totally insecure and breaks the HTTP specification for POST. Isn't anyone else concerned that sensitive data will appear in access logs, or could be sniffed via the URI?
Answers.UserDisplayName: Mike Stairs
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-04-09T17:18:52.733Z
Answers.Text: I was told we could instead pass these parameters within the content body, which works up to a point. Any chained data is ignored, only the base entity is created. If you could in fact encrypt the parameters that would actually alleviate my concerns.
Answers.UserDisplayName: Mike Stairs
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-04-09T17:19:00.470Z
Answers.Text: I'm also shocked that api key/site key are also exposed via URI, given that these could be used to generate destructive commands by anyone who intercepts these keys. Obviously we will only allow HTTPS, but security is still a major concern here.
Answers.UserDisplayName: Mike Stairs
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-04-10T08:09:23.817Z
Answers.Text: I believe that you can pass all those params into POST rather appending to url.
Answers.UserDisplayName: Pradeep Nayak
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-04-08T22:34:49.090Z
Answers.LastActivityDate: 2019-04-08T22:34:49.090Z
Answers.UserDisplayName: Pradeep Nayak
Body: <p>when I try to chain commands in the content body of a POST, the contact is created fine, but the chained address is not created. I am not OK with passing sensitive donor information as parameters in the URI (which is against the HTTP protocol specifications for a valid reason), so I need to figure out what the expected syntax is for body contents:</p>
  
  <p>contact_type=Individual&amp;first_name=joe&amp;last_name=blow&amp;api.Address.create={"location_type_id":"Home","street_address":"123 somewhere st"}</p>
  
  <p>passed in the URI, the above works fine...</p>
  
  <p>in the header I'm specifying Content-Type: application/x-www-form-urlencoded
  and json=1 in the URI</p>
  
Tags: <api><rest>
Title: POST format for a chained create
ThreadText: # POST format for a chained create
  
  (Asked by: username_0 on 2019-04-08)
  
  when I try to chain commands in the content body of a POST, the contact is created fine, but the chained address is not created. I am not OK with passing sensitive donor information as parameters in the URI (which is against the HTTP protocol specifications for a valid reason), so I need to figure out what the expected syntax is for body contents:
  
  contact\_type=Individual&first\_name=joe&last\_name=blow&api.Address.create={"location\_type\_id":"Home","street\_address":"123 somewhere st"}
  
  passed in the URI, the above works fine...
  
  in the header I'm specifying Content-Type: application/x-www-form-urlencoded
  and json=1 in the URI
  
  **Tags:** api, rest
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2019-04-11. Score: 2
  
  @pfigel in chat.civicrm.org responded that this is possibly a problem with encoding. This works for him:
  
  ```
  curl -X POST 'http://civicrm.example.com/sites/all/modules/civicrm/extern/rest.php' -H 'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' --data 'api_key=hunter2&key=hunter2&entity=Contact&action=create&json=%7B%22contact_type%22%3A%22Individual%22%2C%22first_name%22%3A%22John%22%2C%22last_name%22%3A%22Doe%22%2C%22api.Address.create%22%3A%7B%22location_type_id%22%3A%22Home%22%2C%22street_address%22%3A%22Main+Street%22%7D%7D'
  
  ```
  
  
  ---
  
  ### Answer by username_2 on 2019-04-08. Score: 1
  
  CiviCRM allows you to send api params in POST by encrypting the params in json. Here is an example on how you can build api params used in REST call
  
  ```
  http://www.domain.org/sites/all/modules/civicrm/extern/rest.php?entity=Contact&action=create&api_key=userkey&key=sitekey&json={"contact_type":"Individual","first_name":"test","last_name":"test","api.Address.create":{"location_type_id":"Home","street_address":"123 somewhere st"}}
  
  ```
  
  You can use api explorer to build your params.
  
  [![enter image description here](https://i.sstatic.net/3vbyz.png)](https://i.sstatic.net/3vbyz.png)
  
  Thanks
  
  username_2
  
  > **Comments:**
  > **username_3**: Quick question: When you say "encrypt" do you mean "encode"? It's not actually encrypted, right?  
  > **username_2**: I meant json encoded  
  > **username_0**: you've missed the point of my question. I know you can chain the parameters via the URI. This is totally insecure and breaks the HTTP specification for POST. Isn't anyone else concerned that sensitive data will appear in access logs, or could be sniffed via the URI?  
  > **username_0**: I was told we could instead pass these parameters within the content body, which works up to a point. Any chained data is ignored, only the base entity is created. If you could in fact encrypt the parameters that would actually alleviate my concerns.  
  > **username_0**: I'm also shocked that api key/site key are also exposed via URI, given that these could be used to generate destructive commands by anyone who intercepts these keys. Obviously we will only allow HTTPS, but security is still a major concern here.  
  > **username_2**: I believe that you can pass all those params into POST rather appending to url.  
  
  ---
  
  