I am developing external component in Sitecore Content Hub 4.X. I want to call REST API as a current logged user. Custom component expose some options, for example options.api but it is only text...


but how to call for example options.api.entities using credentials of already logged user?

3 Answers 3


The call will be authenticated based on the Content Hub cookies you have. So it will use the logged in user to make the call.

You can use jQuery to make the call, the library is already loaded.

   url: `${options.api.entities.href}&skip=0&take=10`,
   contentType: 'application/json',
   type: 'get',
   success: (data) => {
  • this works for get, but doesn't for post :/ I am api user and I assigned myself to all groups and still 403 is returned. Commented May 21, 2021 at 8:11
  • you will need X-Auth-Token in header for POST
    – josedbaez
    Commented Jul 7, 2021 at 8:13
  • I just faced the same problem, only GET works in this way, in order to make POST, PUT, DELETE requests either X-Auth-Token or oAuth token have to be used. That means username and password (in case OAuth used - also client id and secret) have to be hardcoded somewhere in external user component. This makes such writable requests challenging, and the scenario if one would like to run them in context of the currently logged in users - impossible Commented Oct 19, 2021 at 13:07

After some help from colleagues, I was able to get the way to perform PUT and POST requests without any additional authentication (it shares then current cookies). There are jQuery extension methods $.rest.put(url, objecttoput) and $.rest.post(url, objecttopost) that can do that:

You can look for examples into browser dev tools. For example:

enter image description here

UPD: there is also method $.rest.del(url) to do a DELETE request


As a workaround, we use content hub scripts and provide them current user name.

On ExternalComponent we call the Script with pre-defined authToken for script user:

const userName = options.user.name;
fetch(scriptUrl, {
  headers: {
    'Content-Type': 'application/json',
    'x-auth-token': options.config.authToken
  body: JSON.stringify({

On the Script side impersonate MClient with that user:

var data = Context.Data as JObject;
var userName = data["userName"].Value<long>();
var authenticatedClient = await MClient.ImpersonateAsync(userName);

Then you can call the APIs as usual.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.