api endpoints with authorize, #51