# Rails: ActiveModel::ForbiddenAttributesError

**Code:** `ActiveModel::ForbiddenAttributesError (strong parameters)` · **Category:** Ruby / Rails · **Seen on:** Ruby

You passed raw `params` to `new/create/update`, but strong parameters require permitting attributes first.

## Meaning

Use `params.require(:user).permit(:name, :email)` (a private `user_params` method), then `User.create(user_params)`. `params.to_unsafe_h` bypasses protection — avoid it. In APIs with JSON make sure the root key matches `require`.

## Common causes

- `User.new(params[:user])` without `permit`
- Permitted list missing a nested hash/array (`permit(tags: [])`)
- Using `params` instead of `user_params` in update
- Root key mismatch (wrap_parameters)
- Upgrade from Rails 3 `attr_accessible`

## Quick fix

1. `def user_params; params.require(:user).permit(:name, :email); end`
2. Use `User.create(user_params)`
3. Permit nested: `permit(:name, address: [:street, :city], tag_ids: [])`

## Detailed fix by platform

### Rails

1. `params.require(:post).permit(:title, :body, tag_ids: [])`

## How to diagnose

1. **Call** — Uses permitted params?
2. **Nested** — Permitted?
3. **Root** — Correct key?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/ruby/rails-forbidden-attributes-error)