# cURL: Operations not allowed

**URL:** <https://discuss.dgraph.io/t/curl-operations-not-allowed/18967>\
**Category:** Dgraph Cloud / Slash GraphQL\
**Created:** [October 5, 2023, 11:54pm UTC](https://discuss.dgraph.io/t/curl-operations-not-allowed/18967 "2023-10-05T23:54:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ualinker](https://avatars.discourse-cdn.com/v4/letter/u/f4b2a3/32.png) [@ualinker](https://discuss.dgraph.io/u/ualinker)\
**Post date:** [October 5, 2023, 11:54pm UTC](https://discuss.dgraph.io/t/curl-operations-not-allowed/18967/1 "2023-10-05T23:54:52Z")

</div>

Hey folks, I’m trying to reach Dgraph’s cloud GraphQL endpoint via cURL, but to no avail.  
Here’s the request:

```auto
$ curl -i -X POST -H "Content-Type: application/json" -H "Authorization: Bearer ..." https://xxx.eu-central-1.aws.cloud.dgraph.io/graphql -d '{"query":"query MyQuery {\n getUser(id: \"0x1a5048b0ae\") {\n name\n id }\n }"}'

```

Response:

```auto
HTTP/2 200
date: Thu, 05 Oct 2023 23:37:47 GMT
content-type: application/json
content-length: 74
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Accept-Encoding, Content-Length, X-Auth-Token, sentry-trace, DG-Auth, sentry-trace, DG-Auth
access-control-allow-methods: *
access-control-allow-origin: *
server: Caddy

{"data":null,"errors":[{"message":"Operations not allowed -- [getUser]"}]}%

```

This is exact query that I’ve copied over from cloud web UI, it’s working there. There’s a topic with similar title concerning multiple queries and using different access method, but this one is very simple cURL 1-query request, which for some reason does not pass.

---

<div class="post-metadata">

**Author:** ![matthewmcneely](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/matthewmcneely/32/4774_2.png) [@matthewmcneely](https://discuss.dgraph.io/u/matthewmcneely)\
**Post date:** [October 6, 2023, 12:38am UTC](https://discuss.dgraph.io/t/curl-operations-not-allowed/18967/2 "2023-10-06T00:38:20Z")

</div>

Hey @ualinker,

This error message is coming from the Dgraph cloud controller. Can I ask what you have your Anon Access set to?

That setting is found in the Schema → Access tab on your cloud dashboard.

---

<div class="post-metadata">

**Author:** ![ualinker](https://avatars.discourse-cdn.com/v4/letter/u/f4b2a3/32.png) [@ualinker](https://discuss.dgraph.io/u/ualinker)\
**Post date:** [October 6, 2023, 11:06am UTC](https://discuss.dgraph.io/t/curl-operations-not-allowed/18967/3 "2023-10-06T11:06:19Z")

</div>

Hello Matthew, thank you for your help!

My anonymous access was turned off.  
When I turned it on an adjusted rights - I was able to perform the query.  
But I don’t need anonymous access to be on, since I am using API token authorization. I realised that the issue was with the header: GraphQL endpoint expects token to be within `X-Auth-Token` header, not `Authorization`.