GET method of a REST API returns a 401 Unauthorized error instead of prompting for credentials in a browser on the Australia release and later Issue: When a REST API endpoint is accessed directly in a browser on an authenticated session, the instance now returns a 401 Unauthorized error without prompting for credentials. On Zurich and earlier releases, the same action prompted for username and password. This behavior change applies to all REST API types, including Table APIs and Scripted REST APIs. Symptoms: Opening a REST API endpoint(GET method) directly in a browser URL returns 401 UnauthorizedNo credential prompt appears (unlike Zurich or earlier releases)The endpoint works correctly through authenticated API clients (REST tools, scripts, integrations) that include CSRF tokensError logs show: CSRF validation failed as token is null or emptyBehavior applies to both Table APIs (/api/now/table/[table_name]) and Scripted REST APIs. Release:Beginning with Australia Cause:On Zurich and earlier releases, when a browser request lacked a CSRF token, the platform would fall back to prompting for credentials. Beginning with Australia, the platform rejects any REST API request missing a CSRF token immediately with a 401 error instead of prompting. This is a security-by-design change; browser-based direct access to REST endpoints is no longer a supported method. Resolution: To allow browser-based REST API access without a CSRF token, add the endpoint to the CSRF allowlist: Navigate to the list view of the sys_rest_csrf_allow_list table.Select New.In the API Name field, enter the REST API endpoint URI.Select Submit. After adding the endpoint to the allowlist, the API will bypass CSRF token validation and execute successfully from a browser.