exposed web api controller