I'm trying to post/update/delete entries in a channel by posting XML to a URL.

I've created a module with an action URL that does the processing and uses the Channel Entries API to manage the entries but this requires that I am logged in while I post the data.

My question is how can I post the data from a remote server without needing to be logged in?

Is it possible to authenticate a user by IP rather than logging in or emulate a users credentials from within the module?


  • Could you just POST your data using a form and the SafeCracker module? Depending upon how you are submitting your data you could perhaps create the cookies for the login process? I am not sure how appropriate this would be, just a thought.
    – Lea Hayes
    Commented Dec 9, 2012 at 16:22
  • 1
    Or take a look at how SafeCracker handles this in the module code. It does allow for "guests" to post entries. You set up a member group with the permission would want, then set up a member whose ID you use for posting: ellislab.com/expressionengine/user-guide/modules/safecracker/…
    – Anna_MediaGirl
    Commented Dec 9, 2012 at 17:27
  • 1
    @MediaGirl Thanks, I'd dismissed SafeCracked as I needed to do a lot of processing to the data but I'll have a look at that module code for the authentication.
    – Tom
    Commented Dec 10, 2012 at 18:07

3 Answers 3


I've done this by securing the ACT id with a token of sorts, then before calling the API to import the data - I simply create a temporary user session for a superadmin.


function login_temporary_user()
    if( $this->EE->session->userdata['member_id'] == 0) 
        $this->EE->session->create_new_session(1, TRUE);
        $this->EE->session->userdata['group_id']  = 1;
        $this->EE->session->userdata['can_edit_other_entries'] = 'y';
        $this->EE->session->userdata['can_assign_post_authors'] = 'y';

Then you can just call it like so:


This will give your script the privelages it needs to perform insertions and updates if you require.

You could/should of course add additional security in your module to make sure the ACT is being triggered by a trusted source, but will leave that to you to work out. The session variables above should be enough to get you going.

  • Awesome, that's exactly what I need. Can that code be changed to emulate a user group that is already setup to restrict access to a single channel?
    – Tom
    Commented Dec 10, 2012 at 18:02
  • Probably, you'd need to do a bit of debugging for trial/error. Take a look at the comments at the bottom of here: ellislab.com/expressionengine/user-guide/development/api/… $this->EE->api_channel_entries->errors should give you an indication if permission errors are encountered. The docs are patchy on this to say the least. Commented Dec 10, 2012 at 20:40

For an example of an existing approach to this you might want to take a look at how the Entry API module ($) handles this. This addon essentially provides CRUD api for channel entries via REST/XML-RPC (it also supports SOAP too if you happen to really hate yourself).

It does use a member (which I's argue is a good thing, as you can then hook into the native permissions to restrict access to just the channels you need) & I'm not certain how it handles authentication, but for $45 it might well provide a leg up to get you to where you need to go.


Have you considered using DataGrab for this?


I know you can post and update entries via remote XML.

Import data from RSS/ATOM feeds, CSV files and XML files. Other datatypes can be added.

Imports can be saved and re-run

Entries can be updated if the source data changes — keep data synchronized

And there is a setting to delete as well:

Delete old entries

If you check this, DataGrab will delete any entries in the channel that have not been added or updated by this import. This can be useful for maintaining an up-to-date product list, for example, but must be used with care.

You can set saved imports to run via a template and or cron:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.