Enthuware

I think option 4 is not valid answer since the question specifically mentioned

HTTP POST method only

Perhaps remove the word "only" then option 4 is valid.

Actually, the only is for users. i.e. accessible only to users in employee role. This has now been made clear by placing a comma.
thank you for your feedback!
Paul.