security:
    access_control:
      - {path: ^/api, roles: IS_AUTHENTICATED_FULLY}