An Azure-hosted API must read selected Cosmos DB data without storing an account key. What should be configured?

1. Account keys in every API response
2. Anonymous access to the account
3. A supported managed identity and appropriately scoped data-plane role assignment
4. Subscription Reader as a guaranteed item-read role