Use RolesAllowed.
Also add an API to get the path to the deployment file, restricted to admin only. This is reserved for the watchdog.