removed allowed param from api.py