limit requests to internal api for #36