Vtiger web service "sorry! attempt to access restricted file" response

Question

I'm trying to create a lead via a web service request, but I'm getting a "sorry! attempt to access restricted file" response. I read that the most likely culprit is a misconfigured $root_directory url in config.inc.php, but mine is correct. The UI works fine.

I can login and obtain a session name via the webservice but it seems like the "create" operation doesn't work. Here's the code for the create call:

$lead = array('lastname' => 'test', 'assigned_user_id' => '1', 'company' => 'test');

$objectJson = json_encode($lead);
$request = new HTTP_Request2($vtiger_url, 'POST');
$request->addPostParameter(array(
    'operation' => 'create',
    'sessionName' => $sessionName,
    'element' => $objectJson,
    'elementType' => 'Leads',
));

Note that if I change the "elementType" arg to something made up (eg "fskdhfks"), I get an access denied response instead. If I don't add a required field to the $lead array, I (correctly) receive a mandatory field missing error in the response so clearly the create operation is getting through.

Not sure how to proceed with troubleshooting this. Thoughts?

Thanks!

UPDATE

After some debugging, I found where the error happens. The lead is never inserted into the database because the following query fails:

Tue Mar  4 04:30:31 2014,751 [13249] INFO VT - PearDatabase ->ADODB error  Query Failed:insert into vtiger_crmentity (crmid,smcreatorid,smownerid,setype,description,modifiedby,createdtime,modifiedtime) values(?,?,?,?,?,?,?,?)::->[1048]Column 'smownerid' cannot be null

Someway, somehow the assigned_user_id parameter doesn't get through to that piece of code. The lead's lastname and company fields are there but there is no sign of assigned_user_id. Straaange.

Answer 1

The issue was indeed with assigned_user_id. Instead of using the actual ID of the user, vtiger expects something of the format <moduleid>x<userid>

The login result also includes a userID which includes the <moduleid>x prefix. In my case, I didn't want to use that specific userID, but the prefix is valid.

What a pain that was.