default to protected api