make APIs private; they require locking
hide the API methods