ApiBuilder.java

// add this method, and verb variants to ApiBuilder...
public static void get(String path, Function<Javalin, Handler> fn) {
    staticInstance().get(prefixPath(path), fn.apply(staticInstance()));
}

// then you can remove the extra methods from ApiBuilder and Javalin which take the overloads

ThenAddBehaviourWithoutTouchingApiBuilder.kt

val myHandler = Handler { it.status(200) }

// this extension function will fix the readability problem IMHO, and add the security behaviour that you want.
fun Handler.securedBy(vararg roles: Role): (Javalin) -> Handler =
    { j -> Handler { ctx -> j.accessManager.manage(this, ctx, roles.toList()) } }

val whatever = path("users") {
    get("/foo", myHandler.securedBy(ApiRole.ANYONE, ApiRole.USER_READ))
}