APIs run as user