Reuse `model` for response models and fix authorisation.