protect the "no ks" flag api action with api access control