With new security requirements, all the JSON API's require authentication. Now all the URL's are restricted and can only be bypassed with authentication
Here are the list of JSON services that are now accessible with authentication
"/json/console/app/(:appId)/(~:appVersion)/builder/actions")*
"/json/console/app/(:appId)/(~:appVersion)/builder/binder/columns", method = RequestMethod.POST)*
"/json/console/app/(:appId)/(~:version)/datalist/list")*
"/json/console/app/(:appId)/(~:version)/datalist/options")*
"/json/console/app/(:appId)/(~:version)/envVariable/list")*
"/json/console/app/(:appId)/(~:version)/form/tableNameList")*
"/json/console/app/(:appId)/(~:version)/forms")*
"/json/console/app/(:appId)/(~:version)/forms/options")*
"/json/console/app/(:appId)/(~:version)/message/list")*
"/json/console/app/(:appId)/(~:version)/pluginDefault/list")*
"/json/console/app/(:appId)/(~:version)/userview/list")*
"/json/console/app/(:appId)/version/list")*
"/json/console/app/list")
"/json/console/monitor/activity/list")
"/json/console/monitor/completed/list")
"/json/console/monitor/logs/list")
"/json/console/monitor/running/list")
"/json/console/setting/message/list")
"/json/plugin/(:pluginName)/service")*
"/json/plugin/list")
"/json/plugin/listDefault")
"/json/plugin/listOsgi")
"/json/directory/user/sso")
"/json/workflow/currentUsername")
Here are the additional API's which also require authentication
"/json/app/(:appId)/(~:appVersion)/plugin/(:pluginName)/service"
"/json/apps/published/processes"
"/json/apps/published/userviews"
"/json/directory/admin/dept/list"
"/json/directory/admin/employment/list"
"/json/directory/admin/employment/noHaveOrganization/list"
"/json/directory/admin/employment/noInDept/list"
"/json/directory/admin/employment/noInGrade/list"
"/json/directory/admin/grade/list"
"/json/directory/admin/group/list"
"/json/directory/admin/organization/list"
"/json/directory/admin/subdept/list"
"/json/directory/admin/user/deptAndGrade/options"
"/json/directory/admin/user/group/list"
"/json/directory/admin/user/list"
"/json/directory/admin/user/notInGroup/list")
"/json/workflow/activity/sla/list")
"/json/workflow/assignment/accept/(:activityId)")*
"/json/workflow/assignment/complete/(:activityId)")*
"/json/workflow/assignment/completeWithVariable/(:activityId)")*
"/json/workflow/assignment/list")
"/json/workflow/assignment/list/accepted")
"/json/workflow/assignment/list/accepted/count")
"/json/workflow/assignment/list/accepted/process")
"/json/workflow/assignment/list/count")
"/json/workflow/assignment/list/pending")
"/json/workflow/assignment/list/pending/count")
"/json/workflow/assignment/list/pending/process")
"/json/workflow/assignment/process/view/(:processId)")*
"/json/workflow/assignment/variable/(:activityId)/(:variable)")
"/json/workflow/assignment/view/(:activityId)")*
"/json/workflow/assignment/withdraw/(:activityId)")*
"/json/workflow/audittrail/list")
"/json/workflow/closeDialog")
"/json/workflow/package/list")
"/json/workflow/process/abort/(:processId)")*
"/json/workflow/process/latest/(:processId)")*
"/json/workflow/process/list")
"/json/workflow/process/list/package")
"/json/workflow/process/sla/list")
"/json/workflow/process/start/(:processDefId)")*
"/json/workflow/process/variable/(:processId)/(:variable)")
"/json/workflow/process/view/(:processId)")*
"/json/workflow/testConnection")"/json/workflow/variable/list/(:processId)")*