this will explode if `response` is not given in the json. we should check for its presence or catch the exception.
a malformed API request should return a 400 to the caller, not a 500