restrict access to api endpoints