Which API endpoints are essential for authentication vs management to restrict public access?

hi all，I am planning to use Casdoor as the CAS authentication server and have completed the deployment. However, according to security requirements, only the necessary interfaces should be exposed to the public network, and non-essential ones should have IP access restrictions. Could you provide a list of which interfaces are essential for authentication and which ones are management-related and can be blocked from the public network?