fix api leak, update controller methods