Fetching drafts forbidden in Wordpress rest api
I'm the author of the wpapi module, this issue ended up on our issues list https://github.com/WP-API/node-wpapi/issues/325 and represented a bug that we've fixed in the latest release.
Authentication is required when querying for drafts, and not providing authentication can result in this 400 error; however, as noted in the linked issue above, authentication was working for one-off requests. Why the 400? What was happening was that inside wpapi requests we did not properly forward authentication credentials when paging through a collection, so the request to the first page of results would return a 200, then the second page would return a 400 because the second request lacked authentication. We've resolved this bug by always passing on the authentication credentials when paging through collections, and hopefully this doesn't trip anyone else up.
General troubleshooting if you do encounter a 400:
- Are you sure you're authenticated? (try hitting /users/me)
- Does your user have the capabilities required to view draft posts?
And we welcome issues if you do find bugs like this!