private-public in api controllers