make api resources read only