start on a creat build endpoint, just the security part so far