Control Access for Invoking an API