You use a security definer function to ignore the RLS policy (or lack there of assuming RLS is enabled). You can do any security you need with where or if statements in that function. Then you call that function with the API.