Set SECURITY DEFINER for API top-level functions