API updated with session authentication