Protecting API Endpoints