security: api: legacy: false