When POSTing to a Grape endpoint, the incoming data structure is a Hashie::Mash by default.
When saving a new instance of a model, this Hashie will throw a HiddenAttributesProtection error in Rails 4, because of the strong params protection on attribute assignment.
Solution: You need to add this Gem to your Gemfile and bundle it up:
This gem allows mass assignment. It prevents the Hashie::Mash from responding to :permitted? and therefore triggering this behavior in ForbiddenAttributesProtection.
More information can be found here.