REST API functional - no access control, no actions