<p>The <a href="https://github.com/craftcms/commerce/blob/develop/src/controllers/CountriesController.php#L34-L39" rel="nofollow noreferrer">controller action you are hitting</a> returns a template and I think that it is why you are getting this error.</p>
<p>If you don't have <code>headlessMode</code> on (<a href="https://craftcms.com/docs/3.x/config/config-settings.html#headlessmode" rel="nofollow noreferrer">docs</a>) you could make a quick template, add:</p>
<pre><code>{% header &quot;Content-Type: application/json&quot;%}
{{ craft.commerce.countries.getAllCountries() | json_encode() | raw }}
</code></pre>
<p>Which would give you an endpoint you can then reach from your front end.</p>
<p>Alternatively, you could <a href="https://craftcms.com/docs/3.x/extend/" rel="nofollow noreferrer">make a small module/plugin</a> with a <a href="https://craftcms.com/docs/3.x/extend/controllers.html" rel="nofollow noreferrer">controller</a>.</p>

CC BY-SA 4.0
2020-12-15T15:27:19.267Z
2020-12-15T15:27:19.267Z
Oli
<p>You need to provide a CSRF token, alternatively turn it off in your config/general.php file.</p>
<p>Set a token in your twig template:</p>
<pre><code>{% set csrfToken = {
    csrfTokenName: craft.app.config.general.csrfTokenName,
    csrfTokenValue: craft.app.request.csrfToken,
} %}

&lt;script type=&quot;text/javascript&quot;&gt;
    window.Craft = {{ csrfToken|json_encode|raw }};
&lt;/script&gt;
</code></pre>
<p>Then include the CSRF token name and value in your post array (data):</p>
<pre><code>data[window.Craft.csrfTokenName] = window.Craft.csrfTokenValue;
</code></pre>
<p>Alternatively you can set enableCsrfProtection to false in your general config file.</p>

CC BY-SA 4.0
2020-12-15T11:51:15.837Z
CSRF protection is disabled, still I'm getting an error. Also I use headless Craft together with decoupled frontend on Nuxt.js, so I need a way to fetch data with axios on Nuxt.js without using a twig template code.
Alex89
CC BY-SA 4.0
2020-12-15T10:25:29.927Z
2020-12-15T10:25:29.927Z
Syversen
<p>After enabling the headless mode in Craft I'm getting the same error in JSON format:</p>
<p><a href="https://i.sstatic.net/FVklc.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/FVklc.png" alt="enter image description here" /></a></p>
<p>Anyway I guess I have to write some module for that extra functionality.
Thank you for the tips!</p>

CC BY-SA 4.0
2020-12-15T17:44:24.000Z
2020-12-15T17:44:24.000Z
Alex89
<p>I need to fetch a list countries available for shipping in Craft Commerce.</p>
<p>The problem is that I use decoupled frontend on Nuxt.js and I need fetch it with Ajax call and not with the twig code.</p>
<p>I tried to call it in a Postman but it returns me a 403 - Forbidden error with message &quot;User is not permitted to perform this action&quot;.</p>
<p>I couldn't find something about the way of making request through Ajax in Commerce documentation, can you please tell me what I'm doing wrong here?</p>
<p><a href="https://i.sstatic.net/kQBJA.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/kQBJA.png" alt="enter image description here" /></a></p>

<ajax><plugin-craftcommerce3>
Get a list of countries available for shipping with Ajax in Craft Commerce
# Get a list of countries available for shipping with Ajax in Craft Commerce

(Asked by: username_0 on 2020-12-15)

I need to fetch a list countries available for shipping in Craft Commerce.

The problem is that I use decoupled frontend on Nuxt.js and I need fetch it with Ajax call and not with the twig code.

I tried to call it in a Postman but it returns me a 403 - Forbidden error with message "User is not permitted to perform this action".

I couldn't find something about the way of making request through Ajax in Commerce documentation, can you please tell me what I'm doing wrong here?

[![enter image description here](https://i.sstatic.net/kQBJA.png)](https://i.sstatic.net/kQBJA.png)

**Tags:** ajax, plugin-craftcommerce3

---

## 3 answers

### Answer by username_1 on 2020-12-15. Score: 2

The controller action you are hitting returns a template and I think that it is why you are getting this error.
If you don't have headlessMode on (docs) you could make a quick template, add:
{% header "Content-Type: application/json"%}
{{ craft.commerce.countries.getAllCountries() | json_encode() | raw }}

Which would give you an endpoint you can then reach from your front end.
Alternatively, you could make a small module/plugin with a controller.


---

### Answer by username_2 on 2020-12-15. Score: 2

You need to provide a CSRF token, alternatively turn it off in your config/general.php file.
Set a token in your twig template:
{% set csrfToken = {
    csrfTokenName: craft.app.config.general.csrfTokenName,
    csrfTokenValue: craft.app.request.csrfToken,
} %}



Then include the CSRF token name and value in your post array (data):
data[window.Craft.csrfTokenName] = window.Craft.csrfTokenValue;

Alternatively you can set enableCsrfProtection to false in your general config file.

> **Comments:**
> **username_0**: CSRF protection is disabled, still I'm getting an error. Also I use headless Craft together with decoupled frontend on Nuxt.js, so I need a way to fetch data with axios on Nuxt.js without using a twig template code.  

---

### Answer by username_0 on 2020-12-15. Score: 1

After enabling the headless mode in Craft I'm getting the same error in JSON format:

[![enter image description here](https://i.sstatic.net/FVklc.png)](https://i.sstatic.net/FVklc.png)

Anyway I guess I have to write some module for that extra functionality.
Thank you for the tips!


---

