this should require admin login, which makes consuming the json slightly difficult.