API Treats POST Message Body as Boolean

The variable 
$data
is meant to store the result of 
file_get_contents('php://input')

but is treated like a boolean (probably because it is declared inside the conditional statement). Moving the declaration before the conditional seems to fix the problem. I've attached a patch file.
Postman can now be used to alter entities.

Thanks I will look into this.
It looks like your patch wants to do the reverse.

I'm changing it to
if (!($data = file_get_contents('php://input')) || !($data = json_decode($payload, true))) {

Are you having troubles with Basic Auth or is it just me?

Yeah, I got the diff backwards.

Authorization has been working for me.