<?php

$router->post('menuitem/update', ['as' => 'api.menuitem.update', 'uses' => 'MenuItemController@update']);
$router->post('menuitem/delete', ['as' => 'api.menuitem.delete', 'uses' => 'MenuItemController@delete']);

<?php

$router->group(['prefix' => '/menuitem'], function () {
    post('/update', [
        'as' => 'api.menuitem.update',
        'uses' => 'MenuItemController@update',
        'middleware' => 'can:menu.menuitem.update',
    ]);
    post('/delete', [
        'as' => 'api.menuitem.delete',
        'uses' => 'MenuItemController@delete',
        'middleware' => 'can:menu.menuitem.destroy'
    ]);
});

Use new middleware as discussed in chat.
Use new middleware as discussed in chat.

Previousely, any user could update or delete any menu item. Permissions had no effect for api call.