jmix.rest.authenticated-url-patterns = /api/**
Custom REST controller responds 401 Unauthorized only when response header Authorization starts from Bearer.
In any other case (no Authorization header, Basic Authorization, etc.) controller response 200 and html page generated by Vaadin.