worked on authenticated users, lookup, api keys