# Web Services API: SoapException "Security: You are not authorized to use this web service"

**URL:** <https://discuss.workflowgen.com/t/web-services-api-soapexception-security-you-are-not-authorized-to-use-this-web-service/316>\
**Category:** Web API\
**Created:** [December 20, 2013, 1:45am UTC](https://discuss.workflowgen.com/t/web-services-api-soapexception-security-you-are-not-authorized-to-use-this-web-service/316 "2013-12-20T01:45:05Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![wfg-admin](https://yyz2.discourse-cdn.com/flex030/user_avatar/discuss.workflowgen.com/wfg-admin/32/714_2.png) [@wfg-admin](https://discuss.workflowgen.com/u/wfg-admin)\
**Post date:** [December 20, 2013, 1:45am UTC](https://discuss.workflowgen.com/t/web-services-api-soapexception-security-you-are-not-authorized-to-use-this-web-service/316/1 "2013-12-20T01:45:05Z")

</div>

Certain WorkflowGen web service methods require an additional configuration setting to be called by a user.

In the `\wfgen\ws\web.config` file, edit the following key to authorize WorkflowGen administrators to use the secured web methods:

```auto
<add key="ProcessesRuntimeWebServiceAllowedUsers" value="wfgen_admin,MYDOMAIN\myusername" />

```

The value contains a comma-separated list of usernames.

According to your authentication method, the username must be prefixed by the domain name.

The following web service API methods are secured by this setting:

- `RaiseCancelExceptionOnActivityInstance`
- `RaiseCancelExceptionOnActivityInstanceByName`
- `RaiseExceptionOnActivityInstance`
- `RaiseExceptionOnActivityInstanceByName `
- `UpdateProcessInstanceData`
- `StartProcess`, with the `ImpersonateUsername` SOAP or GET/POST parameter