Why http://localhost:4503/api/assets.json with wrong credential giving 200 as responce?

[akshaybhujbale]

Hi 

I am trying to hit http://localhost:4503/api/assets.json using wrong credentials but getting 200 as responce why this is so ?

[milind_bachani]

Hi @akshaybhujbale ,

You dont require authentication on publisher to access /api.
Which is why you see the response even when entering a wrong username.

[Priyanku-Dwivedi · Accepted solution]

Since your instance is running on 4503, so I am assuming it is the publish instance. By default anonymous user in Adobe Experience Manager(AEM) will have the read access to content, so the content can be accessed via publisher directly without providing any credential.
 
and 

GET /api/assets.json retrieves a JSON representation of an asset or a folder within the /content/dam folder., 

Please refer.
https://experienceleague.adobe.com/docs/experience-manager-cloud-service/content/assets/admin/assets...

[Mayank_Gandhi]

@akshaybhujbale publish is open unless you try to access via LB/dispatcher. So all the endpoints would work with anonymous users.