# Anyone else attempting REST calls with version 6?

**URL:** <https://discourse.pi-hole.net/t/anyone-else-attempting-rest-calls-with-version-6/77765>\
**Category:** Community Help\
**Created:** [March 9, 2025, 7:49pm UTC](https://discourse.pi-hole.net/t/anyone-else-attempting-rest-calls-with-version-6/77765 "2025-03-09T19:49:17Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![odin](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/o/87869e/32.png) [@odin](https://discourse.pi-hole.net/u/odin)\
**Post date:** [March 9, 2025, 7:49pm UTC](https://discourse.pi-hole.net/t/anyone-else-attempting-rest-calls-with-version-6/77765/1 "2025-03-09T19:49:17Z")

</div>

When I call the REST endpoint auth and pass in my API key I get a SID to use for the other REST requests. However, when I do I get this error regarding the SID:  
(I have enabled **Permit destructive actions via API** )

```auto
{
  "error": {
    "key": "forbidden",
    "message": "Unable to change configuration (read-only)",
    "hint": "The current app session is not allowed to modify Pi-hole config settings (webserver.api.app_sudo is false)"
  },
  "took": 0.0002167224884033203
}

```

I have

---

<div class="post-metadata">

**Author:** ![yubiuser](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/yubiuser/32/12100_2.png) [@yubiuser](https://discourse.pi-hole.net/u/yubiuser)\
**Post date:** [March 11, 2025, 10:00am UTC](https://discourse.pi-hole.net/t/anyone-else-attempting-rest-calls-with-version-6/77765/2 "2025-03-11T10:00:41Z")

</div>

What password did you use to authenticate? If you used the app password, you need to enable `webserver.api.app_sudo` to be able to change config settings.

But if you use your normal login password, changes should be allowed by default.

---

<div class="post-metadata">

**Author:** ![odin](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/o/87869e/32.png) [@odin](https://discourse.pi-hole.net/u/odin)\
**Post date:** [March 11, 2025, 1:14pm UTC](https://discourse.pi-hole.net/t/anyone-else-attempting-rest-calls-with-version-6/77765/3 "2025-03-11T13:14:55Z")

</div>

I used the app password and tried to use the webserver.api.app\_sudo setting but that seemed to have no effect.

---

<div class="post-metadata">

**Author:** ![yubiuser](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/yubiuser/32/12100_2.png) [@yubiuser](https://discourse.pi-hole.net/u/yubiuser)\
**Post date:** [March 13, 2025, 4:46pm UTC](https://discourse.pi-hole.net/t/anyone-else-attempting-rest-calls-with-version-6/77765/4 "2025-03-13T16:46:24Z")

</div>

Which endpoint did you try which results in this error?

---

<div class="post-metadata">

**Author:** ![rdwebdesign](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/rdwebdesign/32/51363_2.png) [@rdwebdesign](https://discourse.pi-hole.net/u/rdwebdesign)\
**Post date:** [March 13, 2025, 5:28pm UTC](https://discourse.pi-hole.net/t/anyone-else-attempting-rest-calls-with-version-6/77765/6 "2025-03-13T17:28:41Z")

</div>

Please upload a debug log and post **just the token URL** that is generated after the log is uploaded by running the following command from the Pi-hole host terminal:

```auto
pihole -d

```

or if you run your Pi-hole as a Docker container:

```auto
docker exec -it <pihole-container-name-or-id> pihole -d

```

where you substitute `<pihole-container-name-or-id>` as required.

---

<div class="post-metadata">

**Author:** ![yubiuser](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/yubiuser/32/12100_2.png) [@yubiuser](https://discourse.pi-hole.net/u/yubiuser)\
**Post date:** [March 13, 2025, 8:11pm UTC](https://discourse.pi-hole.net/t/anyone-else-attempting-rest-calls-with-version-6/77765/7 "2025-03-13T20:11:12Z")

</div>

A post was split to a new topic: [API Help](https://discourse.pi-hole.net/t/api-help/77975)

---

<div class="post-metadata">

**Author:** ![odin](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/o/87869e/32.png) [@odin](https://discourse.pi-hole.net/u/odin)\
**Post date:** [March 13, 2025, 7:58pm UTC](https://discourse.pi-hole.net/t/anyone-else-attempting-rest-calls-with-version-6/77765/8 "2025-03-13T19:58:22Z")

</div>

[https://tricorder.pi-hole.net/kXAiUJpy/](https://tricorder.pi-hole.net/kXAiUJpy/)

---

<div class="post-metadata">

**Author:** ![yubiuser](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/yubiuser/32/12100_2.png) [@yubiuser](https://discourse.pi-hole.net/u/yubiuser)\
**Post date:** [March 13, 2025, 8:14pm UTC](https://discourse.pi-hole.net/t/anyone-else-attempting-rest-calls-with-version-6/77765/9 "2025-03-13T20:14:52Z")

</div>

```auto
2025-03-13 14:55:26.385 CDT [13152/T13384] WARNING: API: Unable to change configuration (read-only) (key: forbidden, hint: The current app session is not allowed to modify Pi-hole config settings (webserver.api.app_sudo is false))

```

It seems the config option is still not enabled.

---

<div class="post-metadata">

**Author:** ![odin](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/o/87869e/32.png) [@odin](https://discourse.pi-hole.net/u/odin)\
**Post date:** [March 14, 2025, 3:59pm UTC](https://discourse.pi-hole.net/t/anyone-else-attempting-rest-calls-with-version-6/77765/10 "2025-03-14T15:59:35Z")

</div>

It is enabled. The issue is that any sid that I create seems to be nerfed to read only. I can create them if I use the Pihole API docs page but I need to be able to do this from a remote client.

---

<div class="post-metadata">

**Author:** ![yubiuser](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/yubiuser/32/12100_2.png) [@yubiuser](https://discourse.pi-hole.net/u/yubiuser)\
**Post date:** [March 14, 2025, 8:41pm UTC](https://discourse.pi-hole.net/t/anyone-else-attempting-rest-calls-with-version-6/77765/11 "2025-03-14T20:41:29Z")

</div>

> [@odin](#):
>
> It is enabled

It was not, when you created the debug log.

```auto
[webserver.api]
       max_sessions = 16
       prettyJSON = true ### CHANGED, default = false
       pwhash = "$BALLOON-SHA256$v=1$s=1024,t=32$T8djjdhe" ### CHANGED, default = ""
       totp_secret = ""
       app_pwhash = "$BALLOON-SHA256$v=1$s=1024,t=hdhdjj" ### CHANGED, default = ""
       app_sudo = false
       cli_pw = true

```

Anyway.

* * *

> [@odin](#):
>
> I can create them if I use the Pihole API docs page but I need to be able to do this from a remote client.

Are you using the doc page to create the SID?  
You can easily create a SID from any client on your network.  
See [Authentication - Pi-hole documentation](https://docs.pi-hole.net/api/auth/)

---

<div class="post-metadata">

**Author:** ![Bucking\_Horn](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/bucking_horn/32/18719_2.png) [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)\
**Post date:** [March 29, 2025, 8:39am UTC](https://discourse.pi-hole.net/t/anyone-else-attempting-rest-calls-with-version-6/77765/12 "2025-03-29T08:39:10Z")

</div>

A post was split to a new topic: [Where is the API Key in Pi-hole v6?](https://discourse.pi-hole.net/t/where-is-the-api-key-in-pi-hole-v6/78595)

---

<div class="post-metadata">

**Author:** ![system](https://discourse.pi-hole.net/uploads/default/original/3X/7/c/7c8792f649eeb921c5d2b4c41564ffa873d9a2b8.png) [@system](https://discourse.pi-hole.net/u/system)\
**Post date:** [April 19, 2025, 8:39am UTC](https://discourse.pi-hole.net/t/anyone-else-attempting-rest-calls-with-version-6/77765/13 "2025-04-19T08:39:39Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.