ActionFinish in the API

Last mile of the ActionFinish function to the API
agreed.  This could probably be refactored internally to make the separation between auth and validation logic cleaner.  It's probably not worth the extra functions though?