Restricting API calls to GET