prepared statements in REST API