specs and create action authorized on api