add basic api

blocked for everybody but the superuser at the moment, can add api keys from the admin