api page access control