remove owner from api endpoint

why do we care about `SAFE_METHODS` here?