Restricting requests to an API path prefix