Hello friends, I had enquired on the mailing list about the access to Spaces & Tags on a strictly private wiki. I believe I might have a resolution: Possible Resolution: 1. I checked out the XWiki Platform - Core -REST module for XWiki 2.1.1. 2. As per the original issue, the Pages were not accessible but Spaces were accessible in a private wiki even without authentication. Hence, I found the two class files & compared them, viz. a. SpacesResource.java in package org.xwiki.rest.resources.spaces b. PagesResource.java in package org.xwiki.rest.resources.pages 3. In SpacesResource.java replaced the following code: if (Utils.getXWikiApi(componentManager).exists(homeId)) { home = Utils.getXWikiApi(componentManager).getDocument(homeId); } spaces.getSpaces().add( DomainObjectFactory.createSpace(objectFactory, uriInfo.getBaseUri(), wikiName, spaceName, home)); With the following code: if (Utils.getXWikiApi(componentManager).exists(homeId)) { home = Utils.getXWikiApi(componentManager).getDocument(homeId); if (home != null) { spaces.getSpaces().add( DomainObjectFactory.createSpace(objectFactory, uriInfo.getBaseUri(), wikiName, spaceName, home)); 4. Compiled the module jar & deployed it on the XWiki instance. 5. Now, the spaces show up only when the user has been authenticated through the browser. When there is no authentication, all that is displayed is an empty </spaces> tag. So things do look partly the way I wanted them to work. I have following two questions at this point of time: 1. Is this the right way to do it. Did I end up breaking something else that was working? 2. If this is the correct resolution, how could I add a Status.UNAUTHORIZED when there is no authentication? Any help will be greatly appreciated. Thank you for your time & consideration folks. 2. REST services access to spaces & tags (Dilipkumar Jadhav) Message: 2 Date: Mon, 25 Jan 2010 17:45:27 +0530 From: "Dilipkumar Jadhav" &lt;jadhav.dilipkumar(a)gmail.com&gt; Subject: [xwiki-users] REST services access to spaces & tags To: &lt;users(a)xwiki.org&gt; Message-ID: &lt;4b5d8b69.0404c00a.65db.ffffafa7(a)mx.google.com&gt; Content-Type: text/plain; charset="us-ascii" Hello friends, I am facing some unexpected behavior with RESTful services in private wiki instance: Issue: Spaces, Tags entities can be accessed publicly through REST URL, eventhough XWiki is run in private wiki mode. Description: One of the XWiki 2.1.1 instance is setup in a private wiki mode. Guests are not allowed to register or view any page on this instance. I am also making use of authenticated services (RESTful services & XMLRPC services) for connecting 3rd party applications to this xwiki instance. However, when I access REST URLs for spaces, tags, etc there is no authentication check from XWiki. This data is publicly available. When I access a page URL, I am blocked off for authentication. Couldn't find a JIRA for this one. Could we consider this as an non-consistent behavior in terms of xwiki REST authentication where one resource is blocked while others are not. Has anyone else faced this before or has a work-around to this issue. Thank you for your time & consideration friends. Environment: XWiki : 2.1.1 stable Tomcat: 6.0.20 MySql: 5.0.45 community JDK: 1.5 (Apparently, REST services do not work for me through JDK 1.6. This could be just me facing this issue though J)