In ASP.NET when calling a method in a Controller you might see this message.

This is actually an HTML page being returned with "Access Denied", however you can't see this as JSON can't parse it. It's caused by the user not having enough permission to call the method in the controller because the entire controller has an overriding higher privilege. 

The solution is to update the OnAuthorization method to handle this.

public void OnAuthorization(AuthorizationFilterContext context)