change /purchases endpoint to GET