Limit API calls to staff