Restrict access of partial implmented API in Production

Question

We need to develop an API which takes a CSV file as an input and persists them in database. Using vertical slicing we have split the reuirement into 2 stories

• First story has partial implementation with no data validation
• Second story completes the usecase by adding all validations.

Sprint-1 has first story and sprint-2 has second. After imlemneting first story in sprint-1 we want to release it to production. However, we dont want to make the API accessible to public which would be big security risk as invalid data could be inserted into database (story1 ignores validation)

What is the best strategy to release story1 at the end of sprint1 while addressing such security concerns?

We tried disbling the access via toggle flag such as ConfigCat. However, we dont want to implment something which is not required for actual implementation

Answer 1

is there really such a risk that in 1 sprint, someone may start using the API? And if you haven't added it to any documentation, how would they know of it's existance?

But let's say it is possible - what about using a feature toggle? When the toggle is activated, the end point spits out null or even a HTTP error code. Then you can enable to feature toggle when you're ready for people to start using the endpoint.