Accessing legend of secure services

[ScottSteigerwald]

I'm attempting to access the legend of a secure service.  Right now, if I go to the service itself via:
http://<server>/ArcGIS/rest/services/Private/<mapservice>/MapServer?token=xyz123
I am able to access the map service, no problem.

If I go to:
http://<server>/ArcGIS/rest/services/Private/<mapservice>/MapServer?token=xyz123/legend?f=json
This does not work, and I am sent to the login page instead.

I have tried other iterations, like:
http://<server>/ArcGIS/rest/services/Private/<mapservice>/MapServer/legend?f=json&token=xyz123
to no avail.  I get {"error":{"code":498,"message":"Invalid token","details":[]}} in this case.

If I go to:
http://<server>/ArcGIS/rest/services/Private/<mapservice>/MapServer/legend?f=json
and login, I get my legend.

So it seems the legend is not accessible in secure map services using a token.  So is this a bug?  Or a "feature"?

[RaviNarayanan]

Scott,
There are no known issues with accessing the legend resource for a secured service using a token.

the URL syntax is
http://<mapservice url>/legend?f=json&token=<token>

was the token generated for an IP or a referer.

if it was generated for a referer it will work only when the legend resource is accessed from an application where the referer header will be set.

if you a trying to access the legend resource directly typing the URL in the browser, use a ip address option when generating the token.
thanks
Ravi

[ScottSteigerwald]

I've tried that exact URL (third one in my original post) and receive an error.  Do you suggest I contact support to resolve this issue?