The ArcGIS Server REST API works out of the box without special configuration. However, if you need to change the defaults, an understanding of the various configuration points is required.
You can adjust the Services Directory settings using the ArcGIS Server Administrator Directory under system > handlers > rest > servicesdirectory > edit. From here, you can apply changes directly, or you can write scripts that call the Edit Services Directory operation in the ArcGIS REST API.
The following sections give more detail about some of the settings on the edit page.
If the client includes an Origin header in the request, the REST instance will determine whether or not this origin has cross-domain access. If it has access, it will include an Access-Control-Allow-Origin header in the response, and the value will echo the value of the Origin header. If it does not have access, it will not include this response header.
By default, the REST API allows access to all domains. To restrict access, you need to specify a new AllowedOrigins property. The value should be a comma-delimited list of allowed domains.
The ArcGIS Server token service supports cross-origin access and will always allow access to all domains.
Example: allowedOrigins=https://foo, https://bar:9090
ArcGIS Online Map Viewer Classic URL
Using the View in ArcGIS Online Map Viewer Classic link in the Services Directory, you can preview map, image, and feature services in the ArcGIS Online Map Viewer Classic. By default, the Services Directory is configured to use the Map Viewer Classic in www.arcgis.com. Using the ArcGIS.com URL property, you can configure the Services Directory to use Map Viewer Classic from a different portal. The ArcGIS.com Map Text property can be used to configure the text that will be shown for the View In link in the Services Directory.
REST API logging
Logging in the REST API can be configured using ArcGIS Server Manager.