should have been sending the info via request body not query params