Fix exploit with API routing