Lock down the external_id endpoint for now.

This may change as permissions become more fine-grained.