This will probably do what I'm after: https://help.getbraincloud.com/en/articles/1852058-is-there-a-way-to-prevent-a-client-apps-from-making-certain-api-calls
I'm still wondering if there's a reason why AwardUserItem is not blockable via API Blocking?

Hi, I've been experimenting with brain cloud and noticed that I can call UserItems.AwardUserItem as a client and can't find a way to block it. "Cloud Code - API Blocking" does not list it under the UserItems service. This seems rather strange as now a hacked client could just award an unlimited amount of items. Have I misunderstood something or is this a bug?
I've noticed that this kind of blocking can be done for Virtual Currencies though. I believe in never trusting the client and would like to be able to strictly enforce that.