# Unauthorized when accessing custom admin endpoint

**URL:** https://discourse.nodered.org/t/unauthorized-when-accessing-custom-admin-endpoint/20201
**Category:** Developing Nodes
**Created:** [11 January 2020 21:38 UTC](https://discourse.nodered.org/t/unauthorized-when-accessing-custom-admin-endpoint/20201 "2020-01-11T21:38:21Z")
**Posts on this page:** 1
**Showing post:** 4

<div class="post-metadata">

### Author: ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)
#### Post date: [11 January 2020 22:50 UTC](https://discourse.nodered.org/t/unauthorized-when-accessing-custom-admin-endpoint/20201/4 "2020-01-11T22:50:02Z")

</div>

> [@BartButenaers](#):
>
> Although I think it must be a POST when I use permission _'xterm.write'_ , and a GET for permission _'xterm.read'_ ?

No, its `.read` if its something a user with read-only access should have access to and `.write` if its something that requires full read/write access.

Do not equate `read` and `write` with `get` and `post` - there may be things that only a user with full access is allowed to read.

Any endpoint that has `needsPermission` will require the auth header to be set to access. jQuery is setup by us to add that header for any request - so your `$.ajax` requests will work.

The `<script>` loading of `xterm.js` won't work because the browser doesn't know to add the auth header.

In general though, loading static javascript resources don't need to be behind an endpoint protected by `needsPermission`. So the fix would be to add a separate endpoint for serving these resources and don't use `needsPermission` on it.

---

_[View the full topic](https://discourse.nodered.org/t/unauthorized-when-accessing-custom-admin-endpoint/20201)._