when I try to chain commands in the content body of a POST, the contact is created fine, but the chained address is not created. I am not OK with passing sensitive donor information as parameters in the URI (which is against the HTTP protocol specifications for a valid reason), so I need to figure out what the expected syntax is for body contents:

contact_type=Individual&first_name=joe&last_name=blow&api.Address.create={"location_type_id":"Home","street_address":"123 somewhere st"}

passed in the URI, the above works fine...

in the header I'm specifying Content-Type: application/x-www-form-urlencoded and json=1 in the URI


CiviCRM allows you to send api params in POST by encrypting the params in json. Here is an example on how you can build api params used in REST call

http://www.domain.org/sites/all/modules/civicrm/extern/rest.php?entity=Contact&action=create&api_key=userkey&key=sitekey&json={"contact_type":"Individual","first_name":"test","last_name":"test","api.Address.create":{"location_type_id":"Home","street_address":"123 somewhere st"}}

You can use api explorer to build your params.

enter image description here



  • Quick question: When you say "encrypt" do you mean "encode"? It's not actually encrypted, right?
    – Demerit
    Apr 8 '19 at 23:10
  • I meant json encoded Apr 8 '19 at 23:11
  • you've missed the point of my question. I know you can chain the parameters via the URI. This is totally insecure and breaks the HTTP specification for POST. Isn't anyone else concerned that sensitive data will appear in access logs, or could be sniffed via the URI? Apr 9 '19 at 17:18
  • I was told we could instead pass these parameters within the content body, which works up to a point. Any chained data is ignored, only the base entity is created. If you could in fact encrypt the parameters that would actually alleviate my concerns. Apr 9 '19 at 17:18
  • 1
    I believe that you can pass all those params into POST rather appending to url. Apr 10 '19 at 8:09

@pfigel in chat.civicrm.org responded that this is possibly a problem with encoding. This works for him:

curl -X POST 'http://civicrm.example.com/sites/all/modules/civicrm/extern/rest.php' -H 'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' --data 'api_key=hunter2&key=hunter2&entity=Contact&action=create&json=%7B%22contact_type%22%3A%22Individual%22%2C%22first_name%22%3A%22John%22%2C%22last_name%22%3A%22Doe%22%2C%22api.Address.create%22%3A%7B%22location_type_id%22%3A%22Home%22%2C%22street_address%22%3A%22Main+Street%22%7D%7D'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.