求大家帮忙看一下SAP今年ng的一道api design的题

看了很多今年SAP ng今年的面经。这道api出现频率极高，好像还没有太多讨论一个好的做法。希望大家一起看看。Build a user management functionality for a web application.

You must e able to cover the below functionalities:

• Create  a new user on Signup with a unique user id which will be the primary key. This user id should be their email or any other personal details.
• Delete a specific user
• Update the email-id of the user
• Get information of a specifice user using their unique user id
• Get all the users living in San Francisco.
• Update the password of a specific user using their unique user id.
• Get all users that have logged in at lesat once since this week
  

Note: a user would have the following details:

• First name
• Last name
• Email id
• Phone number
• Location
  

Questins:

• Write API endpoints for each of the following functionalities in the given blanks. You are free to use your own naming conventions. For example: GET..../api name?/parameters
• What mechanisms would you put in place to prevent a denial-of-service attack？
  

感觉get的那些要求就是写明一下get的api就行。然后update的那些就是post的api。或者还是有哪方面需要再注意一下？
第二题不是太清楚应该答到什么程度。
希望大家一起来讨论一下。