This question already has an answer here:
I have a publicly available API endpoint. I have to prevent a simple $.ajax script from downloading all of the exposed data within seconds and at least force a page refresh everytime a new request wants to be sent. While this wouldn't entirely protect it, it would help mitigate attacks while non-technical limitations allow us to protect it in a better way.
As a little note, I considered using a nonce in the cookie but that would also mean a page refresh for legitimate clients that need to query the data twice or thrice and that isn't allowed.