DOCSP-45119-REST-API-security

Author: ltran-mdb2

source/api-docs.txt

@@ -31,13 +31,21 @@ you access the application on (either ``8278``, ``8080``, or ``443``).
 How the REST API Works
 ----------------------
 
-The Relational Migrator REST API:
+The Relational Migrator REST API runs on the client computer or server
+on which you install Relational Migrator. By default, Relational
+Migrator does not expose the API to any remote computers. You must make
+all calls to API on the same computer that you are running Relational
+Migrator on. 
 
-- Runs on the client computer or server that the Relation Migrator 
-  application is installed on.
-- The Rest API is controlled by the host adapter binding.
-- The Relational Migrator REST API **does not** currently support 
-  authentication.
+If you want to remotely access the REST API, configure the
+``unattended`` profile by :ref:`installing Relational Migrator on an
+unattended server <unattended-server>`. 
+
+.. warning::
+
+   The REST API does not support authentication. If you use an
+   ``unattended`` profile, users do not need to authenticate to call the
+   API. Using remote access may cause security vulnterabilities.
 
 When to Use REST API
 --------------------