uses apticket verify API