secured api; returns only the sites user is allowed to see.