chore: protect POST/PUT/DELTET api