To allow a system to use the REST API you require the following setup.

Admin > System > API

• ClientID : Named to client, avoid spaces and special characters.
• Client Secret : Auto Generated
• Allowed Actions : Select only ones required to keep security at maximum levels.
• Allowed IPs : ; delimited, used when server to server communication or able to limit to specific range.

Admin > Users

• Account needs creating that is only used for API, must have correct role permissions as normal user for tasks it will be completing.
• Tick check box API Enabled.

Web.config

In some existing installs the following sections may be missing:

<appSettings>
<add key="owin:AutomaticAppStartup" value="true" />

<dependentAssembly>
<assemblyIdentity name="Microsoft.Owin" publicKeyToken="31bf3856ad364e35" culture="neutral" />
<bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0" />
</dependentAssembly>
<dependentAssembly>
<assemblyIdentity name="Microsoft.Owin.Security.OAuth" publicKeyToken="31bf3856ad364e35" culture="neutral" />
<bindingRedirect oldVersion="0.0.0.0-3.1.0.0" newVersion="3.1.0.0" />
</dependentAssembly>
<dependentAssembly>
<assemblyIdentity name="Microsoft.Owin.Security" publicKeyToken="31bf3856ad364e35" culture="neutral" />
<bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0" />
</dependentAssembly>

<remove name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" />
<remove name="ExtensionlessUrlHandler-Integrated-4.0" />
<add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="*" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" /><remove name="OPTIONSVerbHandler" />
<remove name="TRACEVerbHandler" />