--- title: Configuring the REST service --- > Agent instructions: > **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown. > > - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version. > - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt). ## REST prerequisites Before you can enable the Xperience REST service, you must ensure the following: ### In Windows Go to **Control Panel -> Programs and Features** and click **Turn Windows features on or off** in the left menu. #### Windows 8.1 / Windows Server 2012 1. Expand the **.NET Framework 4.5 Advanced Services** item. 2. Make sure that the **WCF Services -> HTTP Activation** feature is installed. #### Windows 10 or 11 1. Expand the **.NET Framework 4.8 Advanced Services** item. 2. Make sure that the **WCF Services -> HTTP Activation** feature is installed. #### Windows Server 2016 / 2019 1. In the Add Roles and Features Wizard, click **Next** until you get to the **Features** step. 2. Expand the **.NET Framework 4.7 Features** item. 3. Make sure that the **WCF Services -> HTTP Activation** feature is enabled. 4. Click **Next** until the **Install** button is enabled. 5. Click **Install** and continue with the wizard. ### In IIS Manager 1. Select the Xperience web site or application for which you want REST to be enabled. 2. Open the **Authentication** configuration. 3. Ensure that **Anonymous** authentication is enabled. You can also have either **Forms** or **Windows** authentication enabled depending on your environment. 4. Disable **Basic** and other types of authentication (leave _Anonymous_ and either _Forms_ or _Windows_ enabled). ![](https://docs.kentico.com/docsassets/13/configuring-the-rest-service/image2013-3-13-15-0-30.png) Once you have these prerequisites met, you can proceed to configuring the REST service in the Xperience instance. ## Configuring the REST service Once you meet the prerequisites for using the REST service, configure the following settings for the Xperience administration application: 1. Edit your application's **web.config** file. 2. Find the **system.webServer** section directly under the root (i.e. not under a specific __ element). 3. Set the **runAllManagedModulesForAllRequests** attribute to _true_ for the opening tag of the **** element: ```html ... ``` 4. Sign in to the Xperience administration interface. 5. Open the **Settings** application. 6. Select the **Integration -> REST** category and configure the settings: | REST setting | Description | | ----------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Service enabled | Enables or disables the Xperience REST service. | | Service enabled for | Choose if the REST service allows access to objects, pages, or both. | | Always check page security | If disabled, security is not checked when accessing published versions of pages. If enabled, security is always checked. | | Page access is read only | If enabled, the REST service only allows GET requests for pages (pages cannot be modified). | | Object access is read only | If enabled, the REST service only allows GET requests for objects (objects cannot be modified). | | Allowed page types | Specifies a list of [page types](https://docs.kentico.com/13/developing-websites/defining-website-content-structure/managing-page-types.md) that the REST service is allowed to access. Enter the code names of page types separated by semicolons.
If empty, all page types are allowed. | | Allowed object types | Specifies a list of object types that the REST service is allowed to access. If empty, all object types are allowed.
Enter object type values separated by semicolons. To find the values for specific object types, open the **System** application in the Xperience administration interface and select the **Object types** tab. | | Generate authentication hash for URL | Click the link to generate an [authentication](https://docs.kentico.com/13/integrating-3rd-party-systems/xperience-rest-service/authenticating-rest-requests.md) hash for specific REST URLs.
Enter the full absolute URL of the REST request, including the protocol, website domain name, virtual directory, [REST path](https://docs.kentico.com/13/integrating-3rd-party-systems/xperience-rest-service/getting-data-using-rest.md), and query string parameters. For example:
_http://mywebsite.com/rest/content/currentsite/en-us/all/news?format=json_
The system adds the authentication hash parameter to the URL. You can copy the URL and use it to perform the REST request without authentication headers.
**Restrictions**:
Only works for GET requests (read only data retrieval)
You cannot use hash parameter authentication for _/all_ object retrieval requests (_\~/rest//all_). | | Default encoding | Sets the character encoding that the REST service uses for requests that do not contain a supported _Accept-Charset_ header. | | Allow sensitive fields for administrators | If enabled, REST requests authenticated using the credentials of users with the Global administrator [privilege level](https://docs.kentico.com/13/managing-users/user-management.md) are allowed to work with data fields that contain sensitive information (for example fields related to passwords).
Requests authenticated under non-administrator users can NEVER access sensitive fields, regardless of this setting's value. | > **Tip:** **Tip**: If you encounter issues with the Xperience REST service in your environment, you can try investigating the WCF traffic using tracing and message logging tools. See the [Tracing and Message Logging](https://docs.microsoft.com/en-us/dotnet/framework/wcf/samples/tracing-and-message-logging) article for more information. ### Enabling upload of large data If you are planning to upload large-size data into Xperience through the REST service, it is necessary to specify the required data size limit in the application's _web.config_ file. This can be done by adding the following elemts into the _****_ section of the web.config file: 1. Insert a __ element into the __ sub-section. 2. Create a __ sub-section and add two __ elements: > **Note:** **Note:** > > - The configuration assumes your website [uses SSL](https://docs.kentico.com/13/securing-websites/deploying-websites-to-a-secure-environment/configuring-ssl.md). Moreover, you need to modify __ of the __ element according to the type of SSL authentication you are using. For more information, refer to the [ element](https://docs.microsoft.com/en-us/dotnet/framework/configure-apps/file-schema/wcf/security-of-webhttpbinding) Microsoft documentation. > - The _baseAddress_ set for each service contains a sample value and needs to be replaced with the actual root address of the REST service (depending on your website's domain name). ```html ... ... ... ... ... ... ... ```