1- name: allow-api-requests 2 action: ALLOW 3 expression: 4 all: 5 - '"Accept" in headers' 6 - 'headers["Accept"] == "application/json"' 7 - 'path.startsWith("/api/")'