The problem is the yes/no options - I want to give access to specific endpoints - but now that’s “all of Cloudflare for everything” which means the web entire.

It used to be you could let Onkyo App™ access the five IPs for onkyo.com and be done with it.