require protected path in order to request internal api methods