add access API to /api/user