no security for rest api for now
using static final for constants