you should return data from api, not selecting here, api always should return only those data that user can see