# Data api - meta endpoint **URL:** \ **Category:** APIs\ **Created:** [August 5, 2023, 5:52am UTC](https://forum.bubble.io/t/data-api-meta-endpoint/276168 "2023-08-05T05:52:56Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![developers7](https://avatars.discourse-cdn.com/v4/letter/d/258eb7/32.png) [@developers7](https://forum.bubble.io/u/developers7)\ **Post date:** [August 5, 2023, 5:52am UTC](https://forum.bubble.io/t/data-api-meta-endpoint/276168/1 "2023-08-05T05:52:56Z")
Hi, apparently I can’t hide (or put behind auth) the meta api i.e /api/1.1/meta It exposes details of things and workflows. I think this is so not secure. Is there a way to restrict it? ---
**Author:** ![antonio1](https://avatars.discourse-cdn.com/v4/letter/a/eb8c5e/32.png) [@antonio1](https://forum.bubble.io/u/antonio1)\ **Post date:** [August 7, 2023, 3:45pm UTC](https://forum.bubble.io/t/data-api-meta-endpoint/276168/2 "2023-08-07T15:45:21Z")
+1 here… is there anyway to restrict access to it? (with api token?) ---
**Author:** ![tylerboodman](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/tylerboodman/32/242142_2.png) [@tylerboodman](https://forum.bubble.io/u/tylerboodman)\ **Post date:** [August 18, 2023, 10:21pm UTC](https://forum.bubble.io/t/data-api-meta-endpoint/276168/4 "2023-08-18T22:21:58Z")
An interesting question, I assumed checking the box “Hide swagger documentation” but apparently that doesn’t do it. @sam.morgan ---
**Author:** ![ihsanzainal84](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/ihsanzainal84/32/245932_2.png) [@ihsanzainal84](https://forum.bubble.io/u/ihsanzainal84)\ **Post date:** [August 22, 2023, 3:02pm UTC](https://forum.bubble.io/t/data-api-meta-endpoint/276168/6 "2023-08-22T15:02:05Z")
Maybe I’m a dummy but what do you mean with your original question? It’s kind of vague and hence why no one responded. ---
**Author:** ![tylerboodman](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/tylerboodman/32/242142_2.png) [@tylerboodman](https://forum.bubble.io/u/tylerboodman)\ **Post date:** [August 22, 2023, 3:19pm UTC](https://forum.bubble.io/t/data-api-meta-endpoint/276168/7 "2023-08-22T15:19:20Z")
Add /api/1.1/meta to the end of your app domain it exposes every workflow name and API endpoint, it’s different from the swagger documentation tho ---
**Author:** ![tylerboodman](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/tylerboodman/32/242142_2.png) [@tylerboodman](https://forum.bubble.io/u/tylerboodman)\ **Post date:** [August 22, 2023, 11:57pm UTC](https://forum.bubble.io/t/data-api-meta-endpoint/276168/8 "2023-08-22T23:57:06Z")
For example here’s the [Bubble.io](http://Bubble.io) entire data structure: [https://bubble.io/api/1.1/meta](https://bubble.io/api/1.1/meta) And all the juicy yes/no fields for if a User is an official Bubble employee, etc. ---
**Author:** ![jared.gibb](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/jared.gibb/32/123329_2.png) [@jared.gibb](https://forum.bubble.io/u/jared.gibb)\ **Post date:** [August 23, 2023, 12:17am UTC](https://forum.bubble.io/t/data-api-meta-endpoint/276168/9 "2023-08-23T00:17:39Z")
Interesting 🧐 🤔 ---
**Author:** ![developers7](https://avatars.discourse-cdn.com/v4/letter/d/258eb7/32.png) [@developers7](https://forum.bubble.io/u/developers7)\ **Post date:** [August 29, 2023, 10:37am UTC](https://forum.bubble.io/t/data-api-meta-endpoint/276168/10 "2023-08-29T10:37:18Z")
@bubble please fix this asap ---
**Author:** ![tauno](https://avatars.discourse-cdn.com/v4/letter/t/b487fb/32.png) [@tauno](https://forum.bubble.io/u/tauno)\ **Post date:** [October 13, 2023, 1:38pm UTC](https://forum.bubble.io/t/data-api-meta-endpoint/276168/11 "2023-10-13T13:38:50Z")
+1 also ---
**Author:** ![SJL](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/sjl/32/93757_2.png) [@SJL](https://forum.bubble.io/u/SJL)\ **Post date:** [December 2, 2025, 11:53pm UTC](https://forum.bubble.io/t/data-api-meta-endpoint/276168/14 "2025-12-02T23:53:02Z")
That’s kinda crazy, but made me feel a lot more comfortable about my app data security. At a high level, being able to get every Bubble user’s full name and profile photo feels like a bit of a privacy breach, but it’s kind of already available through the app anyway.