only require account ID for purchase endpoint