restrict what values can be stored in the api
improve the access control