Server API calls must originate from trusted external systems. A site administrator must grant calling systems access by adding them to the API IP White List using the Open API Configuration application.
Detailed instructions on configuring Server API access through the White List appear in Site Configuration, and also the in Site Administrator Help pages.