api endpoint not using ssl. will likely be moved around to use wildcard