"Web access" is allowed, because the restEndpoint files are under the /delivery path "Access contol list" access is allowed, beause the restEndponts have the bypassWorkspaceAcls property. NOTE ...