question

There's no whitelist for hitting your title's endpoints. If someone wants to make calls against your game's Title ID, and you haven't specifically blocked those endpoint using our permissions system, then they can. Now, they do have to have a valid Session Ticket to make any Client API call, apart from login or password reset, so typically, this isn't an issue. If you are seeing someone making suspicious calls against your title, what are those calls specifically? What IP Addresses are they sourcing from, looking at their player accounts? Is there something you have available in your game that can be cheated (have you turned on the Client API calls for statistics or virtual currency, for example - those are off by default).