limiting api scope