Security

The bundle uses JsonRpcBundle security (ufo_json_rpc.security, see Bundle configuration); there is no separate REST configuration.

# config/packages/ufo_json_rpc.yaml
ufo_json_rpc:
    security:
        protected_api: true        # default: calls require a token
        protected_doc: false       # default: documentation is open
        token_name: 'Ufo-RPC-Token'
        clients_tokens:
            - '%env(resolve:UFO_API_TOKEN)%'
        providers:
            partners:
                api_groups: [partners]
                clients_tokens: ['%env(PARTNERS_TOKEN)%']
            internal:
                api_groups: [internal]
                service: App\Security\InternalTokenValidator   # implements ITokenValidator

Request	Check	Error
REST call	`protected_api`: the token from the `token_name` header is checked by the provider of the entry point's API group, and for groups without a provider, by `clients_tokens`	`401`
OpenAPI / Postman	`protected_doc`: the same check for the document's group	`401`

curl https://example.com/internal/catalog/list -H 'Ufo-RPC-Token: internal-secret'

The group is defined by the route (the import's defaults.api_group), so a token of one group does not open another group's entry point. An api_group parameter in the request does not change the group.
A provider sets either clients_tokens or service implementing Ufo\JsonRpcBundle\Security\Interfaces\ITokenValidator (Providers for API groups).
JSON-RPC returns 403 for an invalid token; REST returns 401 for both a missing and an invalid one.
protected_doc does not protect calls, and protected_api does not protect documentation: they are two independent flags.
Symfony Security firewalls apply to REST paths the same way as to any other routes.

REST routes do not handle CORS preflight (OPTIONS): if OPTIONS is not in the methods of the #[Route] attribute, the response is 405. Configure CORS at the web server level or with a separate bundle.