api authenticated requests