cant we simply solve it with another route? one could argue that we should move all of the unattended controllers to be /api/unattended?