You can extending the core controller for api, add your filter or conditions in it. Here is docs: Backend customization - Controllers - Strapi Developer Docs
This question is just like yours: How to set Limit of a relation - Discussions - Strapi Community Forum