I am creating a Web API (Controller) inside my Sitecore solution by inheriting ServicesApiController and EnableCors attribute. This service will be called from any IPhone/Android Application (currently not sure how they will call).

For initial testing, I created an external console application and calling this API controller inside this.

Then I am loading my Sitecore page and attaching my solution to this (w3wp.exe) process in debug mode, also a breakpoint on my API method.

It is getting called successfully till I am in debugging mode. My external console application is unable to call this API controller method when it is not in debugging mode. I am unaware of any settings that I need to do to get this service called from an external application, while it is hosted in upper environments (Prod/QA).

Are there any configuration settings that I need to modify (only for this API controller and method) without compromising the security for other items?


3 Answers 3


There should be nothing related to debug mode, can you please check it again? If still same problem do below settings:

  1. Make a Log for security related stuffs or other variables in a processor before/after below processor just to check what your request is doing.
<processor type="Sitecore.ItemWebApi.Pipelines.HttpRequest.CheckMode, Sitecore.ItemWebApi" patch:source="Sitecore.ItemWebApi.config"/>
  1. I'm sure you must have applied below settings, still mentioning here, coz being developers sometimes we miss small things :).

    Allow anonymous access or request through valid credentials in the \App_Config\Include\Sitecore.Speak.ItemWebApi.config file like below. Also, Make sure to give proper site name, here it's "website".

<site name="website">
    <patch:attribute name="itemwebapi.mode">StandardSecurity</patch:attribute>
    <patch:attribute name="itemwebapi.access">ReadOnly</patch:attribute>
    <patch:attribute name="itemwebapi.allowanonymousaccess">true</patch:attribute>

OR in Sitecore.Services.Client.config file, do below changes.

<setting name="Sitecore.Services.AllowAnonymousUser" value="true" />

For more details, you can refer page#13-15 of the Web API PDF guide - https://sdn.sitecore.net/upload/sdn5/modules/sitecore%20item%20web%20api/sitecore_item_web_api_developer_guide_sc66-71-usletter.pdf

  • Hi Yogesh. I am trying to create a Web API that will do some authentication and return the web token with HttpStatusCode. I think what you are talking about is the internal Web API which is available with Sitecore. This is my own custom web api that will be called by third party and is part of my Sitecore Solution. I followed the above steps but it didn't worked. Sorry I am a newbie.
    – Amin Sayed
    Commented Sep 22, 2016 at 13:45
  • Yeah, I know, but it really looks weird that code works good in debug mode, not without. I faced such situation (not in web apis), Still, I would suggest to log something in the httpRequestBegin pipelines of ItemWebAPI. Commented Sep 22, 2016 at 13:48

So I had an issue with this custom Web API hosted inside my Sitecore solution, that will be used by a third party to call upon some Authentication and Authorization functionality. I did the following things to make it work:

  1. I mistakenly named my API as ApiController which is actually a built-in Abstract class, so changed it to CustomerAPIController

  2. Removed Cors, as this was no more required.

  3. Inherit from Sitecore.Services.Infrastructure.Web.Http.ServicesApiController

  4. Added this controller in the allowed list.

The third party would send some JSON (along with username, password, deviceId) without any Credentials (to access our API) and we need to have someway to accept these parameters, process/validate it and create and JWT along with Response Status message (200, 401 etc)


By enabling CORS you are enabling Cross Origin Resource Sharing. You would need to supply the domains that would be allowed to call your endpoint. As you are not making a call from an external domain, but from within an App, your request will be cancelled even before any method has been executed, as it's not allowed: https://www.asp.net/web-api/overview/security/enabling-cross-origin-requests-in-web-api

Another problem that often occurs is not specifying or specifying the wrong contenttype for the request. If you are posting/requesting xml/application data/whatever, but the apicontroller only works with application/json, this will break as well.

  • Hey Bas, this API will be called by an External Application. Anyways its resolved. Please check my answer.
    – Amin Sayed
    Commented Oct 11, 2016 at 5:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.