Clarification about supported APIs in Auth0 rules