API:
- api model accepts local calls without a key
- external calls require a key (none in db yet)
- internal error for api, and unauthorized in anticipation of api keys