We're having our custom dashboard that our members log into rewritten by an outsourced agency. It is being done with Angular and will use REST to call the API.

We have a particular custom API call that is giving them the error "SECURITY: All requests that modify the database must be http POST, not GET." This call does not modify the database. It composes and runs a SELECT query using CRM_Core_DAO::executeQuery.

How does the REST security mechanism determine whether a call modifies the database? If it contains handwritten queries will they just have to use a POST request?

1 Answer 1


it's simply based on the name of the action, it has to be starting with get, so get, getsingle and so on are considered readonly and accepts over GET, the rest should be POST.

this being said, not sure using the rest api is the best option, you might want to use the 'normal' ajax backend and the js wrapper part of civi that takes care of calling the api the right way. this assume the same domain for civicrm and the dashboard

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.