api() does automatic authentication if it is required