How to protect an API method from unauthorized access?

Protecting an API method from unauthorized access can be achieved through several security levels:

• Authentication — verifying the identity of the user or system (e.g., via OAuth2, JWT, API keys).
• Authorization — checking access rights to a specific method or resource (roles, permissions).
• Validation of incoming data — to prevent attacks like SQL injections, XSS, etc.
• Using HTTPS — to secure data during transmission.
• Rate limiting — to prevent DoS attacks.

Example: if the API uses JWT, the method checks for the presence and validity of the token, as well as the user's permissions:

@GET
@Path("/secure-data")
@RolesAllowed({"ADMIN", "USER"})
public Response getSecureData(@Context SecurityContext securityContext) {
    if (securityContext.getUserPrincipal() == null) {
        return Response.status(Response.Status.UNAUTHORIZED).build();
    }
    // method logic
}

Thus, a combination of authentication, authorization, and other measures ensures the protection of the API method from unauthorized access.