added security in build query in api