fixed: now requires api route