2

I'm dabbling around in /posts/{id}/comments/add, and I'm trying this query:

https://api.stackexchange.com/2.1/posts/144890/comments/add?site=meta.stackover‌​flow&key=ArbQthisismykeyjyecuJQ((&access_token=2YVSaccesstokenomg))&body=and%20th‌​is%20is%20another%20test

It's giving me a 404:

{"error_name":"no_method","error_message":"this method cannot be called this way","error_id":404}

What am I doing wrong? I can perform the action just fine from the doc page, but I can't from the API itself.

6
  • 1
    You need to POST, not GET. Dec 26, 2013 at 9:10
  • Also related: stackapps.com/q/3897/21692 Feb 14, 2014 at 0:14
  • which id should i use there ? my user_id or question_id ? I get a an error called Applications must have a registered Stack Apps post to write @BrockAdams Aug 18, 2017 at 6:16
  • could you see the comment in stackoverflow account @Undo Aug 18, 2017 at 11:23
  • Not right now @Samson, traveling.
    – user18962
    Aug 18, 2017 at 14:45
  • sure once your free @Undo lets continue this discussion in chat room Aug 18, 2017 at 14:59

1 Answer 1

2

HTTP GET

$.get("https://api.stackexchange.com/2.1/posts/144890/comments/add?site=meta.stackoverflow&key=ArbQjyecuJQ((&access_token=2YVSaccesstokenomg))&body=Another%20API%20test", console.log)
{"error_name": "no_method", "error_message": "this method cannot be called this way", "error_id": 404}

HTTP POST

$.post("https://api.stackexchange.com/2.1/posts/144890/comments/add?site=meta.stackoverflow&key=ArbQjyecuJQ((&access_token=2YVSaccesstokenomg))&body=Another%20API%20test", console.log)
{"error_name": "bad_parameter", "error_message": "`key` doesn't match a known application", "error_id": 400}.

Ignoring the key error (presumably you put an invalid one in the post on purpose, and you have a real one stashed somewhere), Brock Adams' comment appears correct - this API path must be requested using a POST. Which makes a whole pile of sense, as GETs are defined as safe and idempotent operations, while POSTs are neither; and the adding of a comment is neither.

URIs, Addressability, and the use of HTTP GET and POST

§3

In [section 9.1.1], HTTP/1.1 states, the convention is that GET is used for safe interactions and SHOULD NOT have the significance of taking an action other than retrieval. Indeed, if you use GET for interactions with side-effects, your make your system insecure. For example, a malicious Web page publisher outside a firewall might put a URI in an HTML page so that, when someone inside the firewall unwittingly follows the link, that person activates a function on another system within the firewall.

Users accept obligations through other mechanisms than requests to follow a link. Per the HTTP/1.1 specification, designers should use HTTP POST for those interactions.

RFC 2616: HTTP/1.1

§9.1.1

...In particular, the convention has been established that the GET and HEAD methods SHOULD NOT have the significance of taking an action other than retrieval. These methods ought to be considered "safe"...

§9.1.2

Methods can also have the property of "idempotence" in that (aside from error or expiration issues) the side-effects of N > 0 identical requests is the same as for a single request.

The only real problem here is that this is not mentioned anywhere in the Stack Exchange API documentation; I've opened a bug report.

1
  • So are we supposed to be using JsonP in order to call methods that require posts, since our apps aren't on the same domain? I'm having the same issue trying to add/remove favorites. I could swear it worked once on a get request, but it's not working now.
    – Kizmar
    Feb 19, 2015 at 1:40

You must log in to answer this question.