add retrieve data controller api and CORS