internal api need superuser api_key