zammad/app/policies/controllers/applications_controller_policy.rb

class Controllers::ApplicationsControllerPolicy < Controllers::ApplicationControllerPolicy
  default_permit!('admin.api')
end