authorize method is static
implement "list"