add allowEndpoints var to verify #allow-endpoints