set up api routes, not tested