Api name problem solved and security only on /api rest service and not on applying policies.