api: use tempfile instead of own function