REST interface to custom entity type getting constant 403's I created my module and the entity definition using the drupal console. It has not been modified at all. My entity is for a user but for various reasons I won't be using the pre existing user entity.

I installed restui, serialization, hal, basic auth. All working fine.

I have created a REST instance for my entity using the UI; POST &amp; GET using json+hal and basic auth.

Using curl (and Postman) I can create and retrieve a node; I can also retrieve a custom user entity that I created through the UI. All the above was easy, no dramas, took no time at all.

Then it came to creating a custom user entity. No dice. I get persistent 403's and nothing in the message (and nothing logged in watchdog which is handy.)

The auth is using an admin account (in fact 2, I created a new one in a display of desperation); admin users have all permissions by default, but I did add extra permissions to authenticated role also in the off chance that it used that internally. (More desperation.)

I'm clearing the caches every 5 minutes also.

I have sent requests using the X-CSRF-Token header using a mix of fresh and old tokens (ie, requesting new ones before a full request and then trying old ones also). Anybody know how often we should be retrieving new tokens?

I've also tried with no tokens. 

The issue is that I have no idea where this is falling over, so all I can do is flail my arms around in a vain attempt at hitting something useful (I'm sure this was a dungeons and dragons action?)

The body of my POST request has been changed also, but I'm not convinced that it would throw a 403 if incorrect, I'd assume a 'malformed' response would come back or at least a non 403. Can anybody confirm? 

As my entity was created by the console and I can see all the CRUD permissions enabled on my admin roles, where can I go from here?
The answer is quite simple but easy to miss.

The URL I used when I made the GET request; http://apps.dev/app/apps_user/1?_format=hal_json is not the same as the URL required to make POST requests. 

To make a POST request, you change it to http://apps.dev/entity/apps_user?_format=hal_json

None of the URL's in the returned _links property are correct for POST requests.