Restrict access to api resources