API endpoint security requirements ()