diff --git a/rhodecode/config/deployment.ini_tmpl b/rhodecode/config/deployment.ini_tmpl
--- a/rhodecode/config/deployment.ini_tmpl
+++ b/rhodecode/config/deployment.ini_tmpl
@@ -111,6 +111,12 @@ rss_include_diff = false
 show_sha_length = 12
 show_revision_number = true
 
+## white list of API enabled controllers. This allows to add list of
+## controllers to which access will be enabled by api_key. eg: to enable
+## api access to raw_files put `FilesController:raw`, to enable access to patches
+## add `ChangesetController:changeset_patch`. This list should be "," separated
+## Syntax is <ControllerClass>:<function>. Check debug logs for generated names
+api_access_controllers_whitelist =
 
 ## alternative_gravatar_url allows you to use your own avatar server application
 ## the following parts of the URL will be replaced