Hi Jacob, this is correct the create action requires a CSRF token.
Before doing the create action you can obtain a list of CSRF tokens from your session object.
Retrieve the list over association and use the list operation Head to obtain the last one. If no token exists, call the get list operation and check again afterwards.