Revert "Remove the API routes"

This reverts commit eca4d289e85afc29a0044e9e8046315aeb60919a.
Require permissions for API routes