chore: protect POST and PUT api