Adding a record fails with permission denied

[mohamadhayek]

Package version (if known): 3.3

Describe the bug and Steps to Reproduce

I deployed Invenio following the documentation here: https://invenio.readthedocs.io/en/latest/quickstart/quickstart.html
I followed the instruction to create a record: https://invenio.readthedocs.io/en/latest/quickstart/crud-operations.html#crud-operations.

When executing the curl command to add a record:

curl -k --header "Content-Type: application/json" \
    --request POST \
    --data '{"title":"Some title", "contributors": [{"name": "Doe, John"}]}' \
    https://127.0.0.1:5000/api/records/?prettyprint=1

I got Unauthorized (401)

"message": "The server could not verify that you are authorized to access the URL requested invenio

Then I saw documentation on adding a user so I followed the steps here: https://github.com/inveniosoftware/training/tree/v3.1/02-invenio-tour
I created an admin user and got a token for that user. I then added another header to the curl command and it looked like this:

curl -k --header "Content-Type: application/json" --header "Authorization: Bearer $TOKEN\
    --request POST \
    --data '{"title":"Some title", "contributors": [{"name": "Doe, John"}]}' \
    https://127.0.0.1:5000/api/records/?prettyprint=1

I got Permission denied (403)

You don't have the permission to access the requested resource. It is either read-protected or not readable by the server.

Expected behavior

As indicated in the documentation, I should get:

{
  "created": "2019-11-22T10:30:06.135431+00:00",
  "id": "1",
  "links": {
    "files": "https://127.0.0.1:5000/api/records/1/files",
    "self": "https://127.0.0.1:5000/api/records/1"
  },
  "metadata": {
    "contributors": [
      {
        "name": "Doe, John"
      }
    ],
    "id": "1",
    "title": "Some title"
  },
  "revision": 0,
  "updated": "2019-11-22T10:30:06.135438+00:00"
}

[aigentic-net]

Triage note (March 2026)

This appears to be a documentation/configuration issue rather than a code bug. The 403 is expected behavior with default permissions -- Invenio v3.3 ships with restrictive default permissions that require proper access control configuration.

Root cause: The quickstart documentation at the time did not explain that:

1. Record creation requires authentication (a personal access token with appropriate scopes)
2. The default permission factory may deny create actions unless explicitly configured
3. The invenio-records-rest permission settings must be aligned with the instance's access control policy

Likely resolution path:

• Verify this is resolved in current InvenioRDM documentation (which has replaced much of the old quickstart)
• If the old quickstart docs are still linked, update them to include proper auth setup
• Consider closing if InvenioRDM's current docs cover this workflow correctly

Priority: P1 -- Blocks new users attempting the quickstart tutorial.

[aigentic-net]

Follow-up: recommend closing as documentation/configuration issue.

To reproduce the reporter's expected behavior, two things were missing from the quickstart docs at the time:

1. Authentication: The POST /api/records/ endpoint requires a valid Authorization: Bearer <token> header. The reporter's curl command had a quoting error (missing closing " on the Authorization header), which would produce a 401 regardless of token validity.

2. Permissions: Even with a valid token, the default permission factory in invenio-records-rest denies record creation unless explicitly configured. The instance's RECORDS_REST_DEFAULT_CREATE_PERMISSION_FACTORY must be set to allow the operation for the authenticated user.

Neither of these is a code bug -- they are expected security defaults. The current InvenioRDM documentation covers the authentication flow correctly.

Recommendation: Close as "not a bug" / documentation gap. The quickstart docs have since been updated, and the restrictive defaults are the correct behavior for a framework handling institutional research data.