Hi,

The hash autentication for REST requests works with both authentication types.
The problem is in the hash. It has to be based on full (absolute) URL, i.e. including the domain, so please use the pattern:

http://<yourDomain>{/yourAppVirtualDirectory}/rest/content/site/surroundhealth/en-us/document/Topics?

to generate REST url with correct authentication hash. The {} part is optional if you use virtual directory. Just a note - I would recommend not to publish any functional REST query with authentication hash publicly if it's not intended :) (to keep your data secure)

As for the mentions from the other thread - It wouldn't make sense then to offer the hash authentication, if the user had to be authenticated first :)
It was probably guessed from the behavior, that the authenticated users that try the hashed request (created from url without domain) will see it works if you set the REST to use Forms authentication, as they're forms-authenticated at the moment. The unauthenticated will see the logon prompt and when you use the basic authentication, the 401 will occur.

The hash authentication has higher priority so it's tried first (when there is a hash at all), then the standard authentication methods take place and if both fail, you get 401.

Hope this sheds some more light to the issue.
Should you need any additional details, please feel free to ask.

Regards,
Zdenek C