changed to include secret in api call for item lookup