diff --git a/lib/API/API.php b/lib/API/API.php
index 3c13d8e2f0..0212981bf3 100644
--- a/lib/API/API.php
+++ b/lib/API/API.php
@@ -1,11 +1,14 @@
 <?php
 namespace MailPoet\API;
 
+use MailPoet\Config\AccessControl;
+
 if(!defined('ABSPATH')) exit;
 
 class API {
   static function JSON() {
-    return new \MailPoet\API\JSON\API();
+    $access_control = new AccessControl();
+    return new \MailPoet\API\JSON\API($access_control);
   }
 
   static function MP($version) {
diff --git a/lib/API/JSON/API.php b/lib/API/JSON/API.php
index c7f7304d4a..0a77672a7f 100644
--- a/lib/API/JSON/API.php
+++ b/lib/API/JSON/API.php
@@ -22,8 +22,8 @@ class API {
   private $access_control;
   const CURRENT_VERSION = 'v1';
 
-  function __construct() {
-    $this->access_control = new AccessControl();
+  function __construct(AccessControl $access_control) {
+    $this->access_control = $access_control;
     foreach($this->_available_api_versions as $available_api_version) {
       $this->addEndpointNamespace(
         sprintf('%s\%s', __NAMESPACE__, $available_api_version),
@@ -128,7 +128,7 @@ class API {
         throw new \Exception(__('Invalid API endpoint.', 'mailpoet'));
       }
 
-      $endpoint = new $this->_request_endpoint_class($this->access_control);
+      $endpoint = new $this->_request_endpoint_class();
 
       // check the accessibility of the requested endpoint's action
       // by default, an endpoint's action is considered "private"