protect the rest api