More resource api specs, some security