user authorization
operation api