I was able to solve the problem. I was using [HttpPost("api/orders")] to identify the action in my api controller. It turns out the my webhost's server sees the api as a protected keyword and throws the error. I changed the code to read [HttpPost("server/orders")] and got it to work.