delete api, security