All externally exposed API queries which return protected information should require successful authentication before they can be called. All API endpoints are rate limited(For example public apis are limited with 10 req/sec and 50 req/10 sec). We don't have IP white listing to access to the endpoint. API keys to authenticate UserGuiding API's are stored with encryption. For detailed information about the encryption: Trust Center > Policies > Encryption Policy.