some API work on /challenges and /challenges/id