How to work with Apigility?

Question

Zend Framework

1. how to prevent someone from making POST/PUT/DELETE requests to records in which the user_id is different from the one making the request.
2. how to make an additional method in the API, for example /user/12/ messages
3. how to make a prefix for the entire API so that it is not /user/12 but /api/user/12
4. how to organize access by roles through oauth2