Restricting access to the API's endpoints