we do not want to use the API here since it needs admin access