security:
    access_control:
      - {path: ^/api/, roles: IS_AUTHENTICATED_FULLY}