security - Symfony2 - FOSOauthServerBundle - Firewall configuration - Route Whitelist -

my goal have routes under firewall protected api except some. have firewall configuration this:

security:     acl:         connection: default  providers:     fos_userbundle:         id: fos_user.user_provider.username_email  encoders:     fos\userbundle\model\userinterface: sha512  firewalls:     oauth_token:         pattern:    ^/oauth/v2/token         security:   false      oauth_authorize:         pattern:    ^/oauth/v2/auth         form_login:             provider: fos_userbundle             check_path: /oauth/v2/auth_login_check             login_path: /oauth/v2/auth_login         anonymous: true      api:         pattern:    ^/.*         fos_oauth:  true         stateless:  true         anonymous: false  access_control:     - { path: ^/, methods: [get], roles: [ is_authenticated_anonymously ]}     - { path: ^/doc, methods: [get], roles: [ is_authenticated_anonymously ]}     - { path: ^/resque, methods: [get], roles: [ is_authenticated_anonymously ]}     - { path: /monitor, methods: [get], roles: [ is_authenticated_anonymously ]}     - { path: /users, methods: [post], roles: [ is_authenticated_anonymously ]}     - { path: /users/me/registration/confirm, methods: [get], roles: [ is_authenticated_anonymously ]}     - { path: /users/me/email/confirm, methods: [get], roles: [ is_authenticated_anonymously ]}     - { path: /instants/.*, methods: [put], roles: [is_authenticated_anonymously ]}     - { path: ^/_profiler, roles: [is_authenticated_anonymously]}     - { path: ^/_wdt, roles: [is_authenticated_anonymously]}     - { path: ^/_configurator, roles: [is_authenticated_anonymously]}     - { path: /.*, roles: [ is_authenticated_fully ]} 

but routes /resque, /monitor , others not reachable without access token. doing wrong in configuration? or not possible implement route whitelist?

i had same problem , solved implementing firewall. no road oauth token wont checked. put regex routes in pattern. , don't forget put firewall in front of api firewall since have regex "match all"

    api_anonym_area:         pattern: (^/api/users/forgotten-password/.*)         methods: [post]         security: false