api endpoint protected with jwt