- name: allow-api-routes
  action: ALLOW
  expression:
    all:
    - '!(method == "HEAD" || method == "GET")'
    - path.startsWith("/api/")