rest endpoints for read-only