expose subscription updates and volume refresh as oauth endpoints