permit running w/out an apikey, just return empty on post operations