Managing site customization via API

My guess is that the controller is checking for XHR, maybe try adding:

x-requested-with:XMLHttpRequest