I found the problem. Like usual I struggle for days then I decide to ask online, fiddle a little while waiting for replies and then I find the issue!

The solution make no sense to me but anyway here goes...

In Eventviewer --> System, there was a DNS warning. SAMINC could not be found and later SAMLTD could not be found as well.

So I altered the hosts file to point request made for hostnames SAMINC and SAMLTD  to 127.0.0.1

Like this.

C:\Windows\System32\drivers\etc

# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
# 127.0.0.1 localhost
# ::1 localhost

127.0.0.1 samltd
127.0.0.1 saminc

Then suddenly it all started working.

Hello,

I have exactly the same problem. But your solution here did work out for me. I have a user WEBAPI (Passowrd:WEBAPI) with access to all modules. I have enabled access to Web API too.

When making a request with an authorization header whose value is Basic V0VCQVBJOldFQkFQSQ== 

The outcome is as below:

The log file shows:
-----------------------------

----------------------------------------
Timestamp: 3/15/2020 3:08:40 PM
Message: Error-[Tenant:] [Company:] [Module:] [User:] - Sage 300 Web API encountered an error for Url 'k**sage/.../ARCustomers'.:
Exception Source:
Exception Type: System.UnauthorizedAccessException
Exception Message: Attempted to perform an unauthorized operation.
---- Stack Trace ----


Please someone advice

Have you resolved this issue?  I am having exactly the same problem. 

I had the same issue. It turns out the password for the Sage WEB API user must be in all UPPERCASE or numbers, no lowercase letters are allowed in the Password.

I have all the above still getting status 401. Does anyone have alternatives.
Its frustrating

A few questions:

1. Are webscreens installed?
2. What user are you using to connect to the web API?
3. If admin, have you enabled the admin access to the web API in BOTH places?
4. Have you tried using the Swagger UI to access/update Sage?

1.Yes Webscreen.installed
2. I am using both C# code, POSTMAN, and Swagger,
3. Yes, I have set this tag "<add key="AllowWebApiAccessForAdmin" value="true" />" for both online and api
4.Yes I have

Ok, cool. So it looks on the face of it that it is set up. With regards to 4 you say you've tried the Swagger UI. Did it work? ie did you get data out? Could you update records?

Yeah, Swagger UI has the pop screen for credentials, which I put the correct one but still remain even with wrong or correct logins

Ok, try using the ADMIN credentials there. Make sure you type the user name and password in upper case on that pop up. You've enabled the admin user in the config files so try that first. If you're going to use a different user then you don't need to enable admin. I tend not to use admin myself but to get this off the ground, we can rule out user config by using admin.

Yes, I did that, used the admin credentials, still didn't work

In IIS when you click on Default Web Site and open the Authentication. You should only have Anonymous Authentication enabled. All others should be disabled.

Then...

Open localhost/sage300webapi and when it loads, click on the blue button to open the swagger ui. Expand ARCustomers. Click on the last GET which takes a customer number parameter. The parameters listed should be SAMLTD as the company unless you have changed the default in the config. In the customer number put 1200 click Try it Out! When the prompt pops up, put in your admin user name and password in upper case. Do you get anything back? The URL will be this 

https://localhost/Sage300WebApi/V1.0/-/SAMLTD/AR/ARCustomers('1200')

So you can copy that and paste it into a browser and it will (should) return the JSON. If you're getting a 401 it means you have not authorized.

Give that sage webapi user access to all modules in Sage300. Then sign into the webscreens (/sage300) as that user to confirm that they have rights to Sage300.

Give that sage webapi user access to all modules in Sage300. Then sign into the webscreens (/sage300) as that user to confirm that they have rights to Sage300.

That's a good point. I think you need to log into Sage at least once with that user.

At this point I have done all

Logged in with API User created and given all right, I have also tried admin

When I try same user on the API, I cant go pass this screen

The only thing I can think of is that when you click Try it Out, have you changed the company name in the fields on the Swagger screen to be the one you are using? If you have and you still cant, I would log a call with Sage support. If you do find a resolution, please let everyone here know in case there is something we all missed.

I found a solution after days, this really an IIS issue. Here is the solution that worked for me

www.greytrix.com/.../

That's a permissions issue. Sage 300 requires that the user have Read & Execute over the programs directory, and Modify rights to the Shared Data directory.

I normally create an app pool for each site and have the app pool run as App pool identity. Then in Sage300's NTFS folder permissions I add the user 'IIS AppPool\<apppoolname>' and set the required permissions.