api post, oauth2
tests, avoid string for null