route needs to be auth/dbc