Technical controls enforce authentication, authorisation and rate limiting on all API endpoints
Enforcing authentication, per-endpoint authorisation and rate limiting on APIs is A.5.15's access control principle applied to machine-to-machine access, not only human logins.
The technical facet enforces authentication, per-endpoint authorization and rate limiting on every API endpoint, the concrete control A.8.26's requirements exist to produce.
API endpoints enforce authentication and per-endpoint authorization technically, extending A.8.5's secure-authentication requirement beyond human sign-in to machine-to-machine access.