adds api for order_details, protected by basic auth

I used a private method instead