Only allow GET methods to API