trying to secure a REST endpoint with JSON token

Question

I'm using codeIgniter to create a service for an app. I have created an endpoint where the user id is passed in as a parameter and then json data for that user is output. On the app when the user logs in I create a JSON token on the server side. I would like to validate this token before the json data from the endpoint is output. I'm not sure how i should go about this. Should i check the token before loading the view in my codeIgniter controller?

I have a profiles_model which includes the following method:

function get_profile($user_id){
        //this function takes in a user_id as a parameter and gets that user's data from the profiles table in the database
        $this->db->from('users');
            $this->db->where('userID', $user_id);
        $query = $this->db->get();
                return $query->result();    //return the result 
    }

and I have a Profiles controller class which includes the following method:

public function get_profile($user_id){
        //this method gets the basic profile info of a user depending on what user id is passed in as a parameter.
        //there are 6 profiles so user id should be between 1 to 6 to return any data 
        $this->load->model('Profiles_model');   //load our Profiles_model
        //create an empty array to store the profile info
        $data['profile'] = array(); 

        foreach($this->Profiles_model->get_profile($user_id) as $key => $value){
            array_push($data['profile'], array('user_id' => $value->userID, 
                    'username' => $value->username,
                    'profile_image' => $value->profileImage,
                    'email_address' => $value->emailAddress));
        }
        //load our json_output.php view and pass in the $data array.
        $this->load->view('json_output', $data);
    }

json_output.php view:

<?php

defined('BASEPATH') OR exit('No direct script access allowed');

if(isset($profile)){
    $output = $profile;
}

$this->output
->set_content_type('application/json', 'utf-8') //content type will be json
->set_output(json_encode($output, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES));

?>

To create the token for login on the app i'm using the JWT php class.

$token = array();
$token['userID'] = $id;

$data['usertoken'] = JWT::encode($token, 'secret_server_key');
echo json_encode($data); //echo back to client side 

for subsequent http requests on the app im sending the token as POST and authenticating it on server side

if(isset($_POST["usertoken"])){
    $token = JWT::decode($_POST['usertoken'], 'secret_server_key');

    echo $token->userID; //this will be not available if the token has been tampered with
}

I would like to use this code (where i check the usertoken post variable) in my endpoint but im not sure where to put it. should i put it in the json_output.php view? thanks

my function in Javascript on client side to retrieve Json.

function generateUserProfile(user_id){
    var url = 'http://www.example.com/app_data/index.php/profiles/get_profile/' + user_id;
    $.getJSON(url ,{format: "json"}).done(function(data){
        var profile_image = "http://www.example.com/" + data[0].profile_image;
        var profile_username = data[0].username + '<i class="fa fa-pencil edit"></i>';
        var profile_email_address = data[0].email_address + '<i class="fa fa-pencil edit"></i>';
        $("#profile_pic").attr('src', profile_image);
        $("#profile_username").html(profile_username);
        $("#profile_email_address").html(profile_email_address);
    }); //end $.getJSON
}