I believe this should be an unauthenticated api route - the same as GET for posts - @sebgie any thoughts?