note private API endpoint