lock down API