The Loginapp REST API must be protected by Airlock Gateway (WAF). Never allow direct access to the Loginapp REST API from untrusted networks.
The Airlock Gateway (WAF) mapping configuration is described in Airlock Gateway for Airlock IAM configuration.
The Denied Access URL has to be configured as described in Authentication & Authorization UI.