Is the best practice to use HTTP Routes or Global Actions for this use case?
P.S. The "api" available to global actions run method says "This client is authorized using a superuser internal api token and has permission to invoke any action in the system using normal API mutations or the Internal API." I interpret this as anyone could call the endpoint. Which is not good?