auto-api finished without security