read is only restricted if it is an external api request.  this might need to change if we want to enfoce strict model-only method queries