last items controller under api/v1 only has a show method, restrict to show only