what are the basis on which I should define resources tag in webapi.xml. for example if I build an api to return product information who can access it. I've searched for that but all I found is what is acl.xml file is used for
Valid values are self, anonymous, or a Magento resource, such as Magento_Customer::group.
- anonymous => everyone can use the API
- self => online logged-in customers can use the API
- Magento resource, such as Magento_Customer::group => only admin users with the specified resource can access the API
An API should be as restrictive as possible to prevent unauthorized uses.