standard layout for api callbacks validation, access control, build response