protect APIs