How can I exclude certain URL paths from “I’m under attack” mode?

The domain mydomain.com, how can i make that everything after mydomain.com/api/ is not subject to anti bot measures

https://mydomain.com/api/v1/guest/payment/notify
should then be excluded too for example

I tried to make a page rule (screenshot), but that didn’t change anything it seems