auth: call `resolveUrl` depending on args
request spec
response spec