Forbidden Attributes Error with Grape and Rails 4

When POSTing to a Grape endpoint, the incoming data structure is a Hashie::Mash by default.

When saving a new instance of a model, this Hashie will throw a HiddenAttributesProtection error in Rails 4, because of the strong params protection on attribute assignment.

Solution: You need to add this Gem to your Gemfile and bundle it up:

hashie-forbidden_attributes

This gem allows mass assignment. It prevents the Hashie::Mash from responding to :permitted? and therefore triggering this behavior in ForbiddenAttributesProtection.

More information can be found here.