added basic API (using endpoints) with tests
using logged on user instead of getting from request