don't accept internal api input from external sources