What is INCORRECT regarding OAuth2 endpoint security?
a. The API Gateway caches an obtained token to invoke a specific endpoint.
b. It is mandatory for the API developer to provide the token endpoint when defining this in the publisher.
c. OAuth2 endpoint security for an API can be enabled using the resource owner password grant type.
d. OAuth2 endpoint security for an API can be enabled using the authorization code grant type.