Well, you can always protect an endpoint by requiring "whatever" condition. Impossing conditions for requests is different than "having a state".

State happens in the client, requests to the backend come with pre-conditions.