restrict json api