Protected by Access + API Shield JWT validation.
The WAF blocks any request where the CF_Authorization JWT is missing, expired, or has the wrong AUD.