redesign: move API call into iframe