Your company runs an Azure Cosmos DB account configured with the Core (SQL) API. Security requires all traffic to the account to flow over a private endpoint from a spoke virtual network, with no public network access. During deployment you notice that when creating the private endpoint for the Cosmos DB account, the portal prompts you to choose a target sub-resource (group ID). Which value must you select so that applications can query the SQL API collections through the private endpoint?