create action and whitelist params