Kibana Rest API redirects to login - api

Question

I'm new to ElasticSearch and Kibana. I'm trying to use Kibana's REST API, but the response i get are redirections to /login whatever the request i try.
The basePath has been modified in kibana.yml :
server.basePath: "/demo"
server.rewriteBasePath: true
Every request, such as :
$ curl -v -u user:passwd -X GET "127.0.0.1:5601/demo/api/features"
gets the following response :
* Hostname was NOT found in DNS cache
* Trying 127.0.0.1...
* Connected to 127.0.0.1 (127.0.0.1) port 5601 (#0)
* Server auth using Basic with user 'user'
> GET /demo/api/features HTTP/1.1
> Authorization: Basic xxxxxxxx
> User-Agent: curl/7.38.0
> Host: 127.0.0.1:5601
> Accept: */*
>
< HTTP/1.1 302 Found
< location: /demo/login?nextUrl=/demo/api/features
< kbn-name: kibana
< content-type: text/html; charset=utf-8
< cache-control: no-cache
< content-length: 0
< connection: close
< Date: Thu, 26 Nov 2020 10:32:56 GMT
<
* Closing connection 0
I'm using v7.2.0 with Linux.
Could someone tell me what i'm doing wrong ?
Best regards

Answer 1

The problem came from the use of the plugin readonlyrest.
First, I had to log in and retrieve the cookie, before querying for anything :
curl -v -X POST "127.0.0.1:5601/demo/login" -d "username=user&password=passwd"-H "kbn-xsrf: true" -H 'Accept: application/json' -c cookie.txt
And then use with the cookie :
curl -v -X GET "127.0.0.1:5601/demo/api/features" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -H "Accept: application/json" -b cookie.txt

Answer 2

In more recent versions of Kibana and ROR we can obtain the cookie with:
curl '127.0.0.1:5601/login' -H 'kbn-xsrf: true' -H 'Content-Type: application/json' --data-raw '{"username":"user","password":"password"}' -c cookie.txt