Enforce API endpoint access restriction

Expose /updates endpoint so we could check update state