With very few exceptions, access to any of the RESTful APIs supported by the DSR requires authentication. Section [The Client Authentication Area](#The-Client-Authentication-Area) describes the specifics of the authentication mechanism. In short, a client must obtain a token from the DSR by providing valid credentials. Once the client has the token, it can access any DSR MMI resource that requires authentication by providing the token in the header of the HTTP request.

Each individual resource action (GET, POST, etc.) described in this API specification includes a "secured by" designation. If the resource action requires authenticated access, this designation is "Secured by x-other". If the resource can be accessed by a client without authentication, the designation is "Secured by none". If the resource can be accessed with or without authentication, both "Secured by x-other" and "Secured by none" are present.

Note that in this release of the API, there are only two resources that can be accessed without authentication - and both of those can also be accessed with authentication.

Any resource action that includes "Secured by x-other" is rendered with a lock icon preceding the action name.
