return whitelist at api without wildcard data