document HTTP endpoints