API endpoint – access restricted