make api fields protected instead of private