ADD: validate authority of API