authenticated calls to the api