Hey mate thanks for responding, this target can't any controled on valid token and user policies for reading data on API program.
And i can acees any end point with api just on valid token