v2 of api - not security