[api] support submit requests from remote projects

but disallow them using a cleanup methode