api for users and roles tested