> Because they used API endpoints used by the frontend we could not use any captcha at this place because of technical requirements

A time sensitive hash validating each request makes it a bit harder for them without significant extra work on your part. Address sensitive is much more effective but can result in issues for users that switch between networks (using your site on the move and passing between workers networks, for instance).