I've been trying to use Sitecore SSC REST API to create an item. I can login, but that is as far as I get - every other request (even to get an item) returns forbidden.

I've already changed the Sitecore.Services.SecurityPolicy to ServicesOnPolicy.

I also don't quite understand how it authenticates the subsequent requests (no api key). I thought it used cookies. The login returns 4 cookies and I have tried using the one that makes sense but still no luck.

Does anyone had success with the API to get item or create item?

The only success I had was by allowing anonymous User. I have also set sitecore/serviceAPI as administrator.

  • I had the security policy setup properly and the request going properly too, but it turns out i had some rewrite rules that were redirecting my login auth, resulting in not getting the right cookies back. You are supposed to get a AspNet.Cookies back and use that token, and i wasn't getting that one back. Removed that rewrite rule and now works fine. FYI Sitecore 9.2
    – nic
    Commented Nov 25, 2019 at 3:15

1 Answer 1


It’s a bit hard to know what’s going on without seeing your code and config and knowing your Sitecore version but some things to check are:

Login Cookies

Are you getting the login cookies from the login endpoint and passing the login cookies in your request to the API? Here is an example of a get item request. The login cookies are created by a separate request which I’ve not included the code for.

HttpWebRequest request = WebRequest.CreateHttp($"https://{_baseAPIUrl}/sitecore/api/ssc/item/{HttpUtility.UrlEncode(parentItemId)}/children?includeStandardTemplateFields=true");
            request.Method = "GET";
            request.ContentType = "multipart/form-data";
            request.CookieContainer = loginCookies;

            using (WebResponse response = request.GetResponse())
                using (Stream stream = response.GetResponseStream())
                    using (StreamReader streamReader = new StreamReader(stream))
                        string responseContent = streamReader.ReadToEnd();

Security Policy

Check your security policy setting is correct. I’d recommend the following which allows remote requests:

    <setting name="Sitecore.Services.SecurityPolicy">
        <patch:attribute name="value" value="Sitecore.Services.Infrastructure.Web.Http.Security.ServicesOnPolicy, Sitecore.Services.Infrastructure" />

The API Docs for 9.0 are here:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.