response specs for api controllers