auth api draft