Expose API with policies