add validation
split api endpoints into two to have different serialization for get and
post

it's nice to have nested objects in GET,
but it's crazy to expect to POST full nested objects