constrain api actions