how to secure aggregate REST services in oracle webcenter sites (12.2.1.3)

hello

we are going to create a site to serve REST content, and by default we see that URLs like

sites / REST / resources / v1 / aggregates /

do not require credentials, so a defaulReader can access to the content. How do we secure those URLs?

from what we see in the documentation is "deny everything by default"

https://docs.oracle.com/en/middleware/webcenter/sites/12.2.1.3/wbcsa/setting-external-security.html#GUID-189B230F-981D-4677-B5/45-052398366CF8

Are we forgetting any property? Does anyone know what steps to take?

regards