restrict api