change access control headers
improve the json api and add swagger docs