allow api calls for certain values only