basic API(broken)
API for todos, without permissions