# API Posts return "You do not have the appropriate permissions?"

**URL:** <https://forum.mattermost.com/t/api-posts-return-you-do-not-have-the-appropriate-permissions/761>\
**Category:** Troubleshooting\
**Created:** [January 13, 2016, 7:41pm UTC](https://forum.mattermost.com/t/api-posts-return-you-do-not-have-the-appropriate-permissions/761 "2016-01-13T19:41:22Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![pbaehr](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mattermost.com/pbaehr/32/381_2.png) [@pbaehr](https://forum.mattermost.com/u/pbaehr)\
**Post date:** [January 13, 2016, 7:41pm UTC](https://forum.mattermost.com/t/api-posts-return-you-do-not-have-the-appropriate-permissions/761/1 "2016-01-13T19:41:22Z")

</div>

I’m working on a Python wrapper for the Mattermost API and I’ve run up against a bit of a wall.

I **am** able to authenticate using group name, email, and password.

I **am** able to get a list of channels or posts.

I **am not** able to do anything so far that requires a POST (like joining or posting to a channel) and I’m having a hard time finding what I’m missing in the client.go and post.go source code.

I’m including my authentication token in the request header and that seems to be working because if I remove it I get a completely different error.

For example, posting a message to a channel (some values redacted):

```
POST /api/v1/channels/{channel_id}/create HTTP/1.1
Host: chat.{server}.com
Authorization: BEARER {my_user_token}
Content-Type: application/json
Cache-Control: no-cache

{Message: "Test"}

```

Returns:

```
{
  "message": "You do not have the appropriate permissions",
  "detailed_error": "userId={my_user_id}",
  "request_id": "#########################",
  "status_code": 403,
  "is_oauth": false
}

```

Am I missing or misunderstanding something?

---

<div class="post-metadata">

**Author:** ![pbaehr](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mattermost.com/pbaehr/32/381_2.png) [@pbaehr](https://forum.mattermost.com/u/pbaehr)\
**Post date:** [January 13, 2016, 8:11pm UTC](https://forum.mattermost.com/t/api-posts-return-you-do-not-have-the-appropriate-permissions/761/2 "2016-01-13T20:11:43Z")

</div>

Replying to myself because of course I figured it out almost as soon as I finally post for help 😉

It looks like my problem was that channel\_id is a required parameter for the post JSON.

It seems redundant to require that since it can be determined from the endpoint URL though, no?